Notion Confirms Exposure of AI Assistant Transcripts After Fireworks AI Breach

Notion has confirmed that a security incident at Fireworks AI exposed transcripts of conversations from its Notion AI assistant, affecting less than 1% of customer workspaces.

Fireworks served as the provider responsible for running classification tasks for the Insights feature and hosting open-weight models within the product. Notion emphasized that its own systems were not breached.

The sequence began on the night of November 2, 2026, when Fireworks notified Notion about unauthorized access to a small dataset. An initial review found only synthetic test data. On the morning of November 3, Notion disconnected its systems from the vendor and deleted stored data. A new alert arrived on November 6, followed by confirmation on November 8 that customer transcripts had been exposed.

According to Notion’s security notice, the majority of transcripts carried no author or workspace labels and did not include results from tool calls. The company stated there is no direct information linking conversations to specific users or organizations, although content typed by users may still identify people and companies.

Notion temporarily disabled the Insights feature and stopped serving models through Fireworks. Affected customers were contacted with instructions to review activity and change passwords, API keys, and other credentials that may have been pasted into Notion AI during the incident window.

Fireworks had earlier detected misuse of internal credentials on October 6 that granted a third party access to environment variables in evaluation workloads. The company disclosed the incident on October 10. On October 23 the attacker reached the development environment via a third-party cloud provider, and on October 24 executed unauthorized workloads.

The latest Fireworks bulletin expanded the scope to include resource metadata, billing information with billing and shipping addresses, invoice and payment history, credit balance and usage data, plus a subset of incomplete model weights and certain customer datasets. The company confirmed that credit card numbers are not stored and were not affected.

Fireworks attributed the activity to a financially motivated cybercriminal group focused on selling access tokens for language models to illicit routing gateways. The technique, known as LLMjacking, involves hijacking the victim’s model with stolen credentials while leaving the legitimate account holder to pay the bill. A recent alert noted an increase in such attacks against AI infrastructure in South America and other regions.