Agentic WeeklyGet The Weekly Verdict, freeSubscribe free

Reported Breaking

Fireworks AI breach exposed some Notion AI chat transcripts, Notion says

Notion says fewer than 1% of its workspaces may have been affected after its inference vendor Fireworks AI was breached, exposing some Notion AI chat transcripts without user or workspace labels. Notion's advice: "We recommend that you treat this data as if it were exposed," and rotate any credentials pasted into Notion AI.

By Agentic Weekly · Evidence: Reported · Editorial standards

Share on X
Facts listed
6
listed below, each from a source we read
We tested
Not tested yet
reported from sources; we did not run it ourselves
Gaps we flag
5
things we could not verify
Sources
5
4 primary, linked below

What happened

Facts the sources state, with the evidence status of each
#What the source saysStatus
01Confirmed. Notion's help center says fewer than 1% of Notion workspaces may have been affected by the Fireworks AI security incident, and that some Notion AI chat sessions without user or workspace labels may have been exposed.Reported
02Confirmed. Notion says the exposed transcripts came from its Insights feature, held no tool call results such as page content, and that no other workspace data was affected. Insights is disabled and Notion no longer serves open-weight models through Fireworks.Reported
03Confirmed. Notion's timeline: Fireworks reported a first dataset (Notion synthetic test data) on the evening of Nov 2, Notion cut off Fireworks by the morning of Nov 3, Fireworks flagged possible customer data on Nov 6 and confirmed the new dataset on Nov 8.Reported
04Confirmed. Fireworks' Nov 9 bulletin says the incident it first disclosed on Oct 9 widened to account and billing information, and for a limited set of accounts to secrets, datasets and incomplete model weights. It says payment card numbers were not affected.Reported
05Confirmed. Fireworks says it found no impact to its Inference, Training SDK and Nexus products, which keep zero data by default, links the attack to a financially motivated "LLMJacking" group, and is working with Palo Alto Networks Unit 42.Reported
06Reported. A Hacker News post shares what it says is Notion's email to an affected workspace owner. We have not seen the email ourselves; Notion's public page describes the same notice process.Reported

reported by the sourcemeasured or run by usnot verified

Primary source: Notion Help Center: Notice about the Fireworks AI incident. On-the-record statements and letters are the source of record; press reports are named and attributed where we use them.

Confirmed vs reported: who says what

Confirmed means Notion or Fireworks AI says it on its own incident page, which we opened on Nov 10, 2026. Reported means a user post says it and neither company has said it publicly.

Each claim, its label and who says so (sources read Nov 10, 2026)
ClaimLabelWho says so
Under 1% of Notion workspaces may be affectedConfirmedNotion help center notice
Exposed data was Insights chat transcripts with no user or workspace labelsConfirmedNotion help center notice
Nov 2 dataset was synthetic test data; customer data flagged Nov 6, confirmed Nov 8ConfirmedNotion security advisory
Fireworks breach reached billing data, and for some accounts secrets, datasets and incomplete modelsConfirmedFireworks Nov 9 bulletin
Attack linked to a financially motivated LLMJacking groupConfirmed (Fireworks' own assessment)Fireworks Nov 9 bulletin
Text of Notion's email to an affected ownerReportedHacker News post

What it means if you use Notion AI or Fireworks

"Unattributable" does not mean harmless. Notion says the chats carried no names or workspace IDs, but a chat transcript can name a person, a client or a project in its own words, and Notion itself tells owners to treat the data as exposed and to rotate any passwords or API keys pasted into Notion AI. If your workspace owner has not heard from Notion, Notion says no action is needed.

The bigger story is the supply chain. Notion users never chose Fireworks; it sat behind Notion's AI features as an inference and classification provider. Fireworks' own bulletin shows how its incident grew: on Oct 9 only stored secrets were known to be accessed, and by Nov 9 the list included billing data, datasets and partial model weights. Any company sending prompts to a third-party model host inherits that host's security, and this is a concrete case of it reaching end users of a brand-name app.

Questions neither company has answered

  • Notion's help page calls the transcripts unattributable, while its advisory says they were unattributable "for the vast majority" of affected workspaces. Were some transcripts tied to a user or workspace, and how many?
  • Over what date range were the exposed Insights transcripts collected, and how many chats does under 1% of workspaces amount to?
  • Which other Fireworks customers had datasets or prompts taken, and have they been told? Fireworks says it is notifying impacted customers but names none.
  • Notion's FAQ says it used volunteered LEAP program data to experiment with training models on Fireworks. Was any of that data in the accessed set?
  • Fireworks says a third-party cloud provider hosting its R&D machines was breached on Oct 23. Which provider, and were its other customers affected?

In the source’s words

“We recommend that you treat this data as if it were exposed.”

“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”

“The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways”

What we have not verified

  • We did not see the exposed data or the affected-workspace review screen, and we have no Notion workspace that was notified.
  • We do not know how many chats or users fall inside the under 1% of workspaces; Notion gives no count.
  • The Fireworks link to an LLMJacking group is the company's own assessment; we did not see Unit 42's findings.
  • The Hacker News email text is a user post; we did not confirm it with Notion.
  • Neither page gives a publish time, so the source time is left blank. We did not contact either company for comment.

This brief is Reported: written from the sources below, not from running the release ourselves.

Sources

Spotted an error? See our corrections policy or email the address on the contact page. Markdown version for agents: /news/fireworks-ai-breach-notion-ai-chat-transcripts.md

Want these briefs in your Google Top Stories? Add Agentic Weekly as a preferred source on Google.

Newsletter

The Weekly Verdict. Free, every Monday.

A free email every Monday: the week's few big AI releases, then 5 short use cases for the new models, each with a prompt you can paste.

Free. Double opt-in. One click to unsubscribe.