Fireworks AI security breach impacts Notion and their customers

The Notion notice has a clear structure, so I’ll follow that order and keep every name, date, and limit in the article.Notion says fewer than 1% of workspaces may have been affected by a security incident at vendor Fireworks AI, after the Notion security team found that some unattributable Notion AI chat sessions may have been exposed. notion.com's report says those chats were not labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results. No other data from inside a workspace is affected, and nothing beyond the transcript words ties a chat to a workspace, user, or company.

This piece covers how Notion used Fireworks, the November shutdown, and how affected owners review chat data inside the workspace. It is for Notion workspace owners and members who use Notion AI, including Enterprise plans and the Learning and Early Access Program. It also covers what to do if passwords, API keys, or other credentials were pasted into Notion AI.

01Unattributable Notion AI chat transcripts

The Notion security team investigated and determined that fewer than 1% of Notion workspaces may have been affected. Some unattributable chat sessions with Notion AI may have been exposed in the Fireworks AI incident. Notion's notice points to Fireworks' official security updates on the Fireworks AI incident.

Notion says "unattributable" means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results. Those missing results include Notion page content and external data pulled in by Notion AI. Beyond the chat transcript itself, Notion says there is no information tying the chat to a specific workspace, user, or company.

Notion says no other data from within the workspace is affected. As a precaution, Notion recommends treating this unattributable data as if it were exposed, and rotating passwords, API keys, or other credentials pasted into Notion AI during this timeframe.

02Insights classification and open-weight models

Fireworks is one of the most-used global AI infrastructure platforms, powering tens of thousands of customers and used by hundreds of thousands of developers. Notion used Fireworks for classification jobs that helped customers understand their own AI usage through a feature called Insights. Notion also used Fireworks as a general inference provider to serve open-weight models inside the product.

The Insights feature has been disabled while Notion investigates this incident, and Notion is no longer serving open-weight models through Fireworks. Those product uses were classification jobs for Insights and general inference for open-weight models. Notion has stopped sending all data and traffic to Fireworks.

Customers in the Learning and Early Access Program, known as LEAP, volunteer their data to help Notion test new AI technology. In the past, Notion used this volunteered data to experiment with training task-specific models on Fireworks. Notion says it has halted all training runs.

03November shutdown and dataset confirmation

Notion says it learned from Fireworks about potential incidents earlier this month and shut down all connections to Fireworks systems out of an abundance of caution. As of November 3, Notion had disconnected its systems from Fireworks, deleted all data in the Fireworks system, and stopped sending all data and traffic to Fireworks. Notion has also halted all training runs.

On November 6, Fireworks notified Notion that malicious actors may have accessed potential customer data, and Notion's team immediately began another internal investigation. On November 8, Fireworks confirmed this new dataset. Upon analysis of that data, Notion discovered unattributable Notion AI chat transcripts used for the Insights feature.

Those transcripts did not contain any tool call results and weren't labeled with who wrote them or which workspace they came from. Beyond the transcript words, Notion says the data contained no information that could specifically identify the workspace, the user, or the company, and no other Notion workspace data is affected. Notion says it continues to monitor the incident.

04Owners contacted for affected workspaces

If neither a member nor that member's workspace owner has heard from Notion, Notion says the workspace is not affected and no action is needed right now. Notion has contacted the workspace owners for the workspaces impacted by the Fireworks AI incident, a set it places at under 1% of Notion workspaces. Affected customers will be able to retrieve and review the affected data securely inside their workspace.

Notion contacted workspace owners. On Enterprise plans, only the owner can see the workspace CSV and the annotated CSV that names the user associated with each chat transcript, while members see their own affected data only after an owner shares a link.

05Security incident review on desktop

Owners of an affected workspace open the data from the workspace sidebar, then ?, then Security incident review. The review requires the desktop app or a web browser on the latest version of Notion, and the data is not accessible on mobile. Notion recommends treating the data as if it were exposed, and rotating passwords, API keys, or other credentials if that sensitive information was pasted into Notion AI during this timeframe.

Workspace owners on Enterprise plans can access a CSV of the workspace's data affected by the incident, and only the workspace owner can see it. They can also access an annotated CSV of the same data with additional metadata, including the user associated with each chat transcript, so the owner can understand and run an analysis of the impact. Those added annotations and metadata were not exposed as part of the incident, and the added fields are marked metadata or analysis respectively.

Notion says these Enterprise resources are available only if the workspace has managed members, and owners with questions should contact their account team. Owners on all other plan types get a page with a link they can share so affected members can review their own data, and that link provides a CSV of only the member's own affected data. Notion's Security page gives an overview of its security and privacy practices, and the Notion Trust Center holds security policies, security audit reports, penetration test results, and additional resources.