🔍 Read the full analysis: What A Fireworks Breach Could Mean For Notion AI Chat Transcripts on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says a dataset accessed by attackers in the Fireworks AI breach included Notion AI chat transcripts used for its Insights feature. It says fewer than 1% of workspaces are affected and that it revoked exposed Notion API keys found in affected messages on November 11. The companies have not explained which Fireworks system retained the data or how long it was stored.
Notion says attackers accessed a dataset containing some Notion AI chat transcripts in the Fireworks AI breach, and that the transcripts had been retained by Fireworks despite a contractual commitment to zero data retention. The company says fewer than 1% of Notion workspaces are affected and that it revoked exposed Notion API keys found in affected user messages on November 11.
In its updated security advisory and Help Center notice, Notion said the dataset Fireworks provided to it on November 8 included chat transcripts used for the Insights feature, which gives workspace administrators information about how teams use AI. Notion says most affected transcripts were “unattributable”: they were not labeled with the writer’s identity or workspace, and did not include tool-call results. That does not mean the text was harmless. Notion defines a transcript as model input or output written to the chat, and says it may contain sensitive information.
Notion said the affected data came from its use of Fireworks for Insights classification jobs, not from every Fireworks-powered product feature. It said AI Meeting Notes were not affected unless their audio, transcript or summary was used as input in a Notion AI chat, and that no other Notion features were affected. The company advises affected customers to treat the data as exposed, review it through its Security incident review process, and rotate any passwords, API keys or other credentials pasted into Notion AI during the incident.
Notion also said it revoked exposed Notion API keys found in affected user messages on November 11. It has not published a count of affected people or transcripts. Its notice says workspace owners or users who have not been contacted have not been identified as part of the affected group.
What a Fireworks Breach Could Mean for Notion AI Chats
Notion says a dataset accessed in the Fireworks AI breach included some chat transcripts used for Insights. Text in an AI chat could contain sensitive information, even when it is not linked to a person or workspace.
What the dataset included
The disclosed transcripts came from Notion’s use of Fireworks for Insights classification jobs.
Inputs and responses
Transcripts could include text people wrote to AI and the model’s replies, which may contain sensitive details.
Often unlabeled
Most affected transcripts were not labeled with a writer or workspace and did not include tool-call results.
Insights use
Notion says AI Meeting Notes were unaffected unless their content was used as input in a Notion AI chat. It says no other features were affected.
What affected customers should do
Notion advises affected customers to treat the data as exposed.
Use Notion’s advisory to determine whether the workspace was identified as affected.
Follow Notion’s Security incident review process.
Change passwords, API keys, or other credentials pasted into Notion AI during the incident.
What remains unclear
The notices leave important questions for customers evaluating AI vendors and data-handling commitments.
- Notion says Fireworks had committed to zero data retention.
- Notion says data from the endpoints it used was nevertheless retained.
- Notion says it disconnected from Fireworks and deleted data in the Fireworks system.
- Which Fireworks system retained the data, and for how long?
- How many people, chats, or transcripts were involved?
- Were other Fireworks customers affected?
What Exposed Chat Text Could Reveal
The disclosure matters because people may put customer names, contract details, internal plans or credentials into AI chats, even when they do not expect those messages to become part of a separate analytics dataset. Notion’s description of transcripts means that ordinary prompt text and model responses could be included; the absence of a user or workspace label does not remove sensitive content from the text itself.
The incident also highlights a gap between a vendor’s stated data-handling commitment and what happened in practice. Notion says Fireworks made a contractual zero-retention commitment, but the investigation found that data from the endpoints Notion used was retained. For organizations buying AI services, the disclosure raises practical questions about what “zero retention” covers, how that promise is checked, and whether stored data for analytics or product features receives different treatment from live model requests.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
As an affiliate, we earn on qualifying purchases.
How Insights Used Fireworks
Notion says it used Fireworks in two ways: to run classification jobs for Insights, and as an inference provider for open-weight models in its product. The newly disclosed transcripts were associated with Insights. Notion’s notice distinguishes this stored-data use from live API requests that generate AI responses.
Notion says its zero-retention arrangements for live requests to third-party model vendors were not meant to cover data it retained to provide features such as chat history and Insights. For Insights, it sent stored Notion AI requests and responses to Fireworks for analysis. Notion’s updated account says Fireworks had agreed contractually not to retain data for Notion’s use of its platform, but that data from the endpoints used was nevertheless retained.
According to Notion’s timeline, Fireworks first notified it on November 2 that a small set of data had been accessed. Notion says it disconnected its systems from Fireworks on November 3, deleted data in the Fireworks system and halted training runs. Fireworks’ own bulletin was last updated November 9, according to the source material, and said it had not detected impact to certain services that are zero-retention by default. It also listed datasets among data accessed for certain customers.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its updated security notice
The Retention Path Is Still Unknown
The notices do not identify which Fireworks system retained Notion’s data, how long it was kept, or how many individual users and messages were involved. They also do not explain why data from the endpoints used by Notion was retained despite the commitment Notion says it received.
Fireworks’ statement that it had not detected an impact to certain zero-retention services does not resolve the question: the companies have not said whether those services were involved in this data retention. The available information also does not establish whether the same issue affected other Fireworks customers. Notion says the affected workspaces represent fewer than 1% of its total, but has not supplied a user-level count or a breakdown of the data types in the dataset.
Vendor Audit and Customer Reviews
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. The next useful public details would include which Fireworks endpoint retained the data, the retention period, and whether other customers’ information was affected. Neither company has provided those answers in the notices described here.
Customers who receive a notice from Notion should review the relevant workspace data and follow the company’s incident guidance, including rotating credentials that may have been entered into chats. Notion’s advisory is the source for determining whether a workspace has been identified as affected; those who have not been contacted have not been identified by the company as part of that group. Further updates from Notion or Fireworks may clarify the scope and the controls being changed.
Key Questions
What Notion AI information was in the dataset?
Notion says it included chat transcripts used for the Insights feature. It defines transcripts as model input or output written to the chat. Notion says most affected transcripts were not labeled with a writer or workspace and did not contain tool-call results.
Were Notion AI Meeting Notes affected?
Notion says AI Meeting Notes were not affected unless audio, a transcript or a summary was used as input in a Notion AI chat. It says no other Notion features were affected.
How many Notion workspaces were affected?
Notion estimates that fewer than 1% of workspaces were affected. It has not published a count of affected people, chats or transcripts.
What should an affected workspace do?
Notion advises affected customers to treat the data as exposed, review it through its Security incident review process and rotate passwords, API keys or other credentials that were pasted into Notion AI during the incident.
Does the notice say how long Fireworks retained the data?
No. The published information does not identify how long the data was retained or which Fireworks system stored it. The companies also have not said whether other Fireworks customers were affected in the same way.
Source: ThorstenMeyerAI.com
