1. Home
2. News
3. Security

Notion says Fireworks AI kept chats it had promised not to store, and attackers reached them

Fewer than 1% of workspaces are hit, and Notion wants anyone who pasted a password into Notion AI to change it.

By Think Facility · November 12, 2026 · AI security AI industry Save

Notion has told customers that some Notion AI chats were caught up in a breach at Fireworks AI, one of the companies it used to run AI models. Its help center notice puts the damage at fewer than 1% of Notion workspaces, and the owners of those workspaces can now download the exposed text exactly as the attacker saw it.

The chats shouldn't have been there at all. Notion says Fireworks had given it a contractual commitment to zero data retention, and its own investigation found the data had been kept anyway.

Who

Fireworks AI, one of Notion's vendors

Workspaces affected

fewer than 1% of Notion workspaces

What was exposed

Notion AI chat transcripts

Notion disconnected from Fireworks

November 3rd

Fireworks' second breach

October 24

How Notion's chats ended up at Fireworks

Notion used Fireworks for two jobs. One was serving open-weight models inside Notion. The other was a feature called Insights, which shows a workspace's administrators how their members use AI. To build those reports, Notion sent stored Notion AI requests and responses to Fireworks to be classified.

Zero data retention, or ZDR, is the promise companies lean on when they hand customer text to an AI provider. Notion's enterprise ZDR covers the requests it sends to model vendors to answer Notion AI prompts. It doesn't cover features that need stored chats, and Insights is one. So Notion kept those chats on its side and relied on Fireworks' contract to keep them off the other.

Notion says that by November 3rd it had disconnected its systems from Fireworks and deleted all its data held there. Insights is switched off while it investigates, and Notion no longer serves open-weight models through Fireworks.

What Fireworks says happened

Fireworks found its first intruder on October 6, using its internal credentials, and published a bulletin on October 9. Back then it said secrets stored for evaluation jobs had been captured, and that it had seen no access to customer datasets, prompts or outputs. It added that its platform doesn't store prompts or outputs by default.

Its updated bulletin goes a lot further. A cloud provider hosting Fireworks' research machines was breached on October 23, and on October 24 the attacker used that foothold to reach Fireworks' development machines and run a workload of their own. Fireworks now lists account and billing details among what was exposed and, for some customers, datasets and incomplete model weights. It says card numbers weren't touched, because it doesn't store them.

Fireworks ties that group to LLMJacking, and points to research Google's threat intelligence group and Mandiant published on November 2. The update doesn't mention Notion, or retention.

Wiz has been keeping a running list of breaches at AI developer platforms it calls Black October. Fireworks is the first name on it, and Wiz logged both the Fireworks update and Notion's notice on November 10. Railway, which we covered on November 11, is on the same list.

What this means if you use AI at work

Most people typing into an AI feature at work never see the chain behind it. Notion's account shows one: the app sends your chat to a model vendor, keeps a copy for an analytics feature, then sends that copy to a second company to sort. A contract at each step said what would happen to the text. By Notion's account, one of them didn't hold.

Notion's advice to affected teams is blunt. Treat the data as exposed, and if anyone pasted passwords, API keys or other credentials into Notion AI, rotate them right away. I'd put the API keys first, because that's what these attackers are hunting.

That's from Google's LLMJacking research, which also found cumulative charges reaching $1 million at some organizations before access was cut off. The bill lands on the company whose key was stolen.

Owners of affected workspaces will find the files in the sidebar's help menu, under Security incident review. There's a list of affected members, and the text itself for owners who've verified their workspace's domain. Notion says it's now auditing its critical vendors, inference providers among them, to check they keep to their zero data retention policies.