# Fireworks AI breach exposed some Notion AI chat transcripts, Notion says

Canonical: https://theagenticweekly.com/news/fireworks-ai-breach-notion-ai-chat-transcripts · Evidence: Reported · First seen: 2026-11-10 09:45 UTC · Source published: not stated by the source · Brief published: 2026-11-10 10:00 UTC · Updated: 2026-11-10 10:00 UTC · Author: Agentic Weekly

> Notion says fewer than 1% of its workspaces may have been affected after its inference vendor Fireworks AI was breached, exposing some Notion AI chat transcripts without user or workspace labels. Notion's advice: "We recommend that you treat this data as if it were exposed," and rotate any credentials pasted into Notion AI.

## What happened

- **Confirmed.** Notion's help center says fewer than 1% of Notion workspaces may have been affected by the Fireworks AI security incident, and that some Notion AI chat sessions without user or workspace labels may have been exposed.
- **Confirmed.** Notion says the exposed transcripts came from its Insights feature, held no tool call results such as page content, and that no other workspace data was affected. Insights is disabled and Notion no longer serves open-weight models through Fireworks.
- **Confirmed.** Notion's timeline: Fireworks reported a first dataset (Notion synthetic test data) on the evening of Nov 2, Notion cut off Fireworks by the morning of Nov 3, Fireworks flagged possible customer data on Nov 6 and confirmed the new dataset on Nov 8.
- **Confirmed.** Fireworks' Nov 9 bulletin says the incident it first disclosed on Oct 9 widened to account and billing information, and for a limited set of accounts to secrets, datasets and incomplete model weights. It says payment card numbers were not affected.
- **Confirmed.** Fireworks says it found no impact to its Inference, Training SDK and Nexus products, which keep zero data by default, links the attack to a financially motivated "LLMJacking" group, and is working with Palo Alto Networks Unit 42.
- **Reported.** A Hacker News post shares what it says is Notion's email to an affected workspace owner. We have not seen the email ourselves; Notion's public page describes the same notice process.

## Confirmed vs reported: who says what

Confirmed means Notion or Fireworks AI says it on its own incident page, which we opened on Nov 10, 2026. Reported means a user post says it and neither company has said it publicly.

Each claim, its label and who says so (sources read Nov 10, 2026)

| Claim | Label | Who says so |
| --- | --- | --- |
| Under 1% of Notion workspaces may be affected | Confirmed | [Notion help center notice](https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor) |
| Exposed data was Insights chat transcripts with no user or workspace labels | Confirmed | [Notion help center notice](https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor) |
| Nov 2 dataset was synthetic test data; customer data flagged Nov 6, confirmed Nov 8 | Confirmed | [Notion security advisory](https://www.notion.com/en-gb/security/advisories/security-incident-involving-a-third-party-ai-vendor) |
| Fireworks breach reached billing data, and for some accounts secrets, datasets and incomplete models | Confirmed | [Fireworks Nov 9 bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident-update) |
| Attack linked to a financially motivated LLMJacking group | Confirmed (Fireworks' own assessment) | [Fireworks Nov 9 bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident-update) |
| Text of Notion's email to an affected owner | Reported | [Hacker News post](https://news.ycombinator.com/item?id=50436636) |

## What it means if you use Notion AI or Fireworks

"Unattributable" does not mean harmless. Notion says the chats carried no names or workspace IDs, but a chat transcript can name a person, a client or a project in its own words, and Notion itself tells owners to treat the data as exposed and to rotate any passwords or API keys pasted into Notion AI. If your workspace owner has not heard from Notion, Notion says no action is needed.

The bigger story is the supply chain. Notion users never chose Fireworks; it sat behind Notion's AI features as an inference and classification provider. Fireworks' own bulletin shows how its incident grew: on Oct 9 only stored secrets were known to be accessed, and by Nov 9 the list included billing data, datasets and partial model weights. Any company sending prompts to a third-party model host inherits that host's security, and this is a concrete case of it reaching end users of a brand-name app.

## Questions neither company has answered

- Notion's help page calls the transcripts unattributable, while its advisory says they were unattributable "for the vast majority" of affected workspaces. Were some transcripts tied to a user or workspace, and how many?
- Over what date range were the exposed Insights transcripts collected, and how many chats does under 1% of workspaces amount to?
- Which other Fireworks customers had datasets or prompts taken, and have they been told? Fireworks says it is notifying impacted customers but names none.
- Notion's FAQ says it used volunteered LEAP program data to experiment with training models on Fireworks. Was any of that data in the accessed set?
- Fireworks says a third-party cloud provider hosting its R&D machines was breached on Oct 23. Which provider, and were its other customers affected?

## In the source's words

> "We recommend that you treat this data as if it were exposed."
> (Notion Help Center, notice about the Fireworks AI incident, https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor)

> "For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models."
> (Fireworks AI, update on October 2026 security incident (Nov 9, 2026), https://fireworks.ai/security/bulletins/october-2026-security-incident-update)

> "The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways"
> (Fireworks AI, update on October 2026 security incident (Nov 9, 2026), https://fireworks.ai/security/bulletins/october-2026-security-incident-update)

## What we have not verified

- We did not see the exposed data or the affected-workspace review screen, and we have no Notion workspace that was notified.
- We do not know how many chats or users fall inside the under 1% of workspaces; Notion gives no count.
- The Fireworks link to an LLMJacking group is the company's own assessment; we did not see Unit 42's findings.
- The Hacker News email text is a user post; we did not confirm it with Notion.
- Neither page gives a publish time, so the source time is left blank. We did not contact either company for comment.

## Timeline

- Source published: not stated by the source
- First seen by our watcher: 2026-11-10 09:45 UTC (via Watcher: Hacker News front page (AI posts) signal; every claim checked against Notion's and Fireworks AI's own incident pages)
- Brief published: 2026-11-10 10:00 UTC

## Sources

- [Notion Help Center: Notice about the Fireworks AI incident](https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor) (primary source) (fetched 2026-11-10)
- [Notion security advisory: Fireworks AI incident (updated Nov 9, 2026)](https://www.notion.com/en-gb/security/advisories/security-incident-involving-a-third-party-ai-vendor) (primary source) (fetched 2026-11-10)
- [Fireworks AI: Update on October 2026 security incident (Nov 9, 2026)](https://fireworks.ai/security/bulletins/october-2026-security-incident-update) (primary source) (fetched 2026-11-10)
- [Fireworks AI: October 2026 security incident (original bulletin)](https://fireworks.ai/security/bulletins/october-2026-security-incident) (primary source) (fetched 2026-11-10)
- [Hacker News: user post with Notion's notice email (claim)](https://news.ycombinator.com/item?id=50436636) (fetched 2026-11-10)

## Related

- [Notion AI: verdict and setup guide](https://theagenticweekly.com/tools/notion-ai)
- [Breaking news briefs](https://theagenticweekly.com/news/breaking)
- [All news briefs](https://theagenticweekly.com/news)
- [New AI models this week](https://theagenticweekly.com/models/this-week)

## How to cite

Agentic Weekly, "Fireworks AI breach exposed some Notion AI chat transcripts, Notion says", published 2026-11-10 10:00 UTC, https://theagenticweekly.com/news/fireworks-ai-breach-notion-ai-chat-transcripts