Notion AI chats exposed in a breach at one of Notion’s AI vendors, Fireworks AI, and fewer than 1% of Notion workspaces may be affected. Notion says its own systems weren’t hacked, but the chat content that leaked is real. If you got an email from Notion on or after November 9, treat it seriously.
Here are the quick facts:
- Who’s affected: fewer than 1% of Notion workspaces, notified by email on November 9, 2026.
- What leaked: Notion AI chat transcripts processed for the Insights feature.
- Where it happened: Fireworks AI, a third-party provider Notion used for AI inference and classification.
- What Notion did: disconnected from Fireworks on November 3 and deleted its data on the vendor side.
- What you should do: review the exposed content and rotate anything sensitive you pasted into a chat.
If you don’t use Notion, the story still applies. Plenty of apps now send your prompts to an AI vendor you’ve never heard of.
Why Notion AI chats exposed through a vendor is a bigger deal than it sounds
The breach didn’t happen inside Notion. According to GBHackers’ summary of Notion’s statement, Fireworks supported two jobs for Notion: classification work behind Insights, and general inference for open-weight models. Attackers got into Fireworks, and some Notion AI conversations were sitting there.
That’s the part worth sitting with. You trusted Notion with your workspace, but your AI chats also lived on infrastructure you never agreed to or even saw.
Notion says most affected transcripts lack labels showing who wrote them or which workspace they came from. That helps, but it isn’t a safety net. What you typed into the chat can still name people, clients or projects.
What was exposed, and what Notion says was not
| Item | Status | Source or note |
|---|---|---|
| Notion AI chat transcripts (Insights) | Exposed | Confirmed by Notion; fewer than 1% of workspaces |
| Author or workspace labels | Missing in most cases | Content can still identify people or companies |
| Tool call results | Excluded for most workspaces | Per Notion’s statement |
| Notion’s own systems and other features | Not breached | Per Notion |
| Payment card numbers (at Fireworks) | Not exposed | Fireworks says it doesn’t store them |
The table is the optimistic reading. Notion hasn’t shared the exact exposure window, the number of transcripts or the technical entry point, so the full picture isn’t in yet.
How the Fireworks breach unfolded
Fireworks has now disclosed two intrusions, not one. eSecurity Planet reports that the first, detected October 6, exposed environment variables like API keys and access tokens for a limited set of customers. The second came through a cloud provider that hosts Fireworks’ R&D machines.
Fireworks says the evidence points to a financially motivated group interested in LLM-jacking, meaning stealing access to AI services. It has brought in Palo Alto Networks’ Unit 42 and notified law enforcement. The two October incidents may not be the same attacker.
| Date (2026) | What happened |
|---|---|
| Oct 6 | Fireworks first detects unauthorized access |
| Nov 2 | Fireworks tells Notion attackers accessed a small dataset |
| Nov 3 | Notion disconnects from Fireworks and deletes its data there |
| Nov 6 | Fireworks warns customer information may also be involved |
| Nov 8 | Fireworks confirms the final affected dataset |
| Nov 9 | Notion emails affected customers; Fireworks posts an updated bulletin |
Notion first believed the dataset was synthetic test data. It took until November 6 for that view to change, which is a reminder of how slowly vendor incidents can come into focus.
What to do if Notion told you that you were affected
Notion’s guidance is simple. Start with the email, since it holds the secure instructions for retrieving your exposed data.
- Retrieve and read the exposed conversations using the link in Notion’s email.
- Assume anything you pasted into an AI chat is compromised, including snippets of code, client details or internal notes.
- Rotate passwords, API keys and tokens that you typed into chats during the incident period.
- Warn teammates or clients if their information appeared in your conversations.
Rotating a key takes minutes, while a leaked one can sit unnoticed for weeks. If you didn’t get an email, Notion says you haven’t been identified as affected and need no action right now.
Pasting secrets into chat windows is a habit worth breaking either way. We covered a similar slip in our look at Claude Code settings files leaking passwords.
The bigger lesson for teams that run on AI tools
Every AI feature you switch on adds a vendor to your risk list, and often a vendor behind a vendor. Admins should know which sub-processors touch chat data, and what happens to it afterward.
Ask your tools’ makers three plain questions: who processes our prompts, how long do they keep them, and how fast will you tell us if something goes wrong? Notion’s notification came a week after it first heard from Fireworks, which is quick by industry standards but still leaves a gap. For a wider look at incident response with AI providers, see our guide to the Anthropic data incident.
Frequently Asked Questions
Was my Notion account hacked?
No. Notion says its own systems weren’t breached. The exposure happened at Fireworks AI, a third-party provider.
How do I know if my Notion AI chats were exposed?
Notion emailed affected customers on November 9. If you didn’t get one, you haven’t been identified as affected right now, though the investigation is ongoing.
Was payment information leaked?
Fireworks says payment card numbers weren’t exposed because it doesn’t store them. It did report that billing details and invoices were exposed for some of its own customers.
Is it still safe to use Notion AI?
Notion turned off Insights during the investigation and stopped serving open-weight models through Fireworks. That limits repeat exposure, but keep secrets out of any AI chat regardless.
Our take: treat AI chats like email, not like a notepad
This breach is limited, and Notion handled the notification reasonably. Still, your AI conversations are stored data that someone else can lose. Assume anything you type could be read by a stranger one day, keep credentials out of prompts, and check which vendors your workplace AI tools actually rely on.
Leave a Reply