Notion Says the Fireworks AI Breach Exposed Notion AI Chat Transcripts Despite a Zero-Retention Contract. Rotate Any Secret Pasted Into an AI Chat, and Ask Vendors Where Your Prompts Live

Patrick Duggan · Nov 12, 2026 · 7 min read

If you own a Notion workspace, open the sidebar, click ?, and choose Security incident review. If Notion has contacted you, download the affected data and read it. If anyone on your team ever pasted a password, API key or token into Notion AI, rotate it now, whether or not you were contacted. Then do the same for every other AI tool you use: anything typed into an AI chat should be treated as disclosed, and a "zero data retention" promise only covers the path it was written for.

What Notion and Fireworks have confirmed

The primary sources are Notion's security advisory (first published November 9, 2026), Notion's help-center notice on the same incident, and Fireworks AI's own security bulletin, "Update on October 2026 security incident" (last updated November 9, 2026). We read all three in full. Everything in this section is their account, not our observation.

Who is affected: Notion says Fireworks "notified us of a security incident impacting fewer than 1% of Notion workspaces." The population is Notion workspaces. BleepingComputer reported the figure as under 1% of users; Notion's own pages say workspaces, and Notion does not give a count in either unit.
What was taken from Notion's side: "Notion AI chat transcripts used for the Insights feature." Insights is the tool that shows workspace administrators how their members use Notion AI. Notion says "for the vast majority of impacted workspaces" the transcripts were "unattributable", which it defines as "the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results."
What a transcript holds: "Any input to or output from the model that was written to the chat." Unattributable is not the same as harmless. A chat where someone pasted a customer list, a contract or a key carries that content with or without a name on it, which is why Notion tells affected customers to "treat this data as if it were exposed."
What Notion says was not affected: "No other Notion features were affected." AI Meeting Notes audio, transcripts and summaries were not affected "unless it was used as an input in a chat transcript with Notion AI."
What Notion did: by the morning of November 3 it had "disconnected our systems from Fireworks, deleted all data in the Fireworks system, and stopped all communication," and its help page adds that it "halted all training runs." Insights is disabled during the investigation, and Notion is "no longer serving open-weight models through Fireworks."

The timeline, in the sources' own dates

Early October: Fireworks' first bulletin (October 9, updated October 10) described "unauthorized use of internal Fireworks credentials and access to environment variables used in evaluation jobs in a limited number of customer accounts." We covered that and the follow-up in our earlier post on the Fireworks disclosures (linked below).
October 23 and 24: Fireworks says "a third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23. On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact." Fireworks lists resource metadata, billing information and, "for certain customers, a subset of incomplete model weights and datasets" as accessed. Fireworks presents this as further activity in the same October incident; BleepingComputer called it a new breach. The cloud provider is not named.
November 2 (evening): Fireworks told Notion "a small set of data had been accessed." Notion says that dataset was "Notion AI synthetic testing data, and no Notion AI customer data was involved."
November 3 (morning): Notion disconnected and deleted its data at Fireworks.
November 6: Fireworks told Notion "malicious actors may have accessed potential customer data." This is the date Notion's advisory gives for the notification about the under-1% incident.
November 8: Fireworks confirmed the new dataset to Notion.
November 9: Notion published its advisory and Fireworks updated its bulletin.

The part every AI buyer should read twice

Notion's help page answers the question enterprise customers will ask first: "I have ZDR as part of my Enterprise plan. What does it cover?" Notion's answer is that zero data retention "applies to the API requests we send to third party model vendors" to generate responses. Features that need stored conversations, "chat history and Insights", are outside it: "Our zero data retention commitments are not intended to cover these use cases where we are required to retain the data to deliver the feature."

For Insights, Notion "sent the stored requests and responses from Notion AI use to a third party model provider, Fireworks in this case, to run the analysis." Notion says Fireworks had given "a contractual commitment to zero data retention for our use of its platform," and then: "Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used."

So there were two separate gaps. First, a customer's ZDR term never covered the analytics feature, by design. Second, the vendor processing that analytics data had promised not to keep it, and Notion says it kept it anyway. A contract term is a statement of intent. It is not a control you can see working.

Fireworks' bulletin says it has "not detected any impact to Inference, Training SDK and Nexus, which are all zero data retention (ZDR) by default," and that it has "disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while we investigate." Neither company says which Fireworks endpoint retained the Notion data or for how long.

What is not known

How many workspaces or chats are affected. Notion gives only "fewer than 1% of Notion workspaces."
The date range of the exposed transcripts. Notion's rotation advice refers to "the timeframe of the incident" without defining it, so if you cannot pin it down, assume any secret ever pasted into Notion AI is in scope.
Which workspaces are not in the "vast majority" of unattributable ones, and what metadata, if any, travelled with their transcripts.
Why the November 2 dataset was first assessed as synthetic test data, and whether the two datasets came from the same access.
Which Fireworks endpoint retained Notion's data despite the contract, and why.
Who the attacker is. Fireworks says its evidence "indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs)," a pattern it calls LLMJacking. We are not adding to that.
Whether any other Fireworks customer had similar data in a retained dataset. Fireworks says it is notifying customers whose data was impacted.

No indicators were published in the sources we read, so we ingested nothing into our feed for this incident.

What to do

Notion workspace owners: sidebar, ?, Security incident review, on a desktop browser with the latest Notion version (it is not available on mobile). Every owner can download a CSV of affected members, with names, emails, user IDs and how many affected rows relate to each. Owners with a verified domain can also download affected_content.csv, the exposed text exactly as accessed, and affected_content_annotated.csv, which adds record, workspace, user and thread IDs, the source date, and an analysis column that flags likely sensitive content. Notion notes the added metadata was not part of what was exposed; it is there to help you triage. Owners without a verified domain cannot see the content files, so verify your domain if you need them.
Share the member link. Owners can copy a link that lets each affected member see only their own data. Members know what they pasted better than an admin does.
Rotate anything that was pasted. Search the content CSV for key prefixes, "password", connection strings and tokens, but do not stop at what the search finds. If a person remembers pasting a credential, rotate it.
Treat every AI chat box as a disclosure. Paste secrets into a secrets manager, never into an assistant. If staff need AI help with configuration, give them a redacted copy.
Ask each AI vendor three questions in writing. Which of our prompts and responses do you store, and for which features (history, analytics, admin insights, evaluation, training)? Which subprocessors receive those stored copies? Does your zero-retention term cover those features and those subprocessors, and how do you verify the subprocessors honour it? Notion's FAQ is a good model of an honest answer to the first question; most vendors have not published one.
If you build on an inference provider yourself, keep stored transcripts used for analytics or training separate from the live inference path, minimize them, and ask your provider for evidence, not a clause, that batch and dataset endpoints do not keep copies.
If you also used Fireworks directly, follow the steps in our earlier Fireworks post: rotate anything stored there, including evaluation-job secrets, and look for the notification email.

How we know, and how we checked

We fetched and read Notion's advisory, Notion's help-center notice and Fireworks' November 9 bulletin directly on November 11, 2026, and quote them above. We used BleepingComputer's two reports (November 10 on Fireworks, November 11 on Notion) for the press framing and noted where they differ from the primaries: BleepingComputer counts users where Notion counts workspaces, and calls the October 23 activity a new breach where Fireworks calls it an update to the October incident. BleepingComputer's Notion story links to its own Fireworks coverage rather than to a Fireworks page; we found Fireworks' bulletin on fireworks.ai ourselves. All the facts here come from two companies' statements about themselves; we have no independent view of either system. This incident has no network indicators or exploited flaw to check against our edge, so we did not run an edge check.

Sources

Notion, "Fireworks AI incident" security advisory, first published November 9, 2026: https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor-nov9
Notion Help Center, "Notice about the Fireworks AI incident that may impact some Notion workspaces": https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor
Fireworks AI, "Update on October 2026 security incident," last updated November 9, 2026: https://fireworks.ai/security/bulletins/october-2026-security-incident-update
Fireworks AI security bulletins index (including the October 2026 bulletin): https://fireworks.ai/security/bulletins
BleepingComputer, "Notion says Fireworks breach exposed customer AI chat transcripts," November 11, 2026: https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/
BleepingComputer, "Fireworks AI discloses new breach after cloud provider hack," November 10, 2026: https://www.bleepingcomputer.com/news/security/fireworks-ai-discloses-new-breach-after-cloud-provider-hack/

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register