🔍 Read the full analysis: Notion Says Fireworks Breach Affected AI Chats Despite Zero Retention on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Notion says a dataset accessed in the Fireworks AI breach included Notion AI chat transcripts used for its Insights feature. The company says fewer than 1% of workspaces are affected and that it revoked exposed API keys found in affected messages on November 11. The companies have not said which Fireworks system retained the data or how long it was stored.
Notion says chat transcripts from its AI service were included in a dataset accessed by attackers in the Fireworks AI breach, despite Fireworks having given Notion a contractual commitment to zero data retention. Notion says the data came from its Insights feature, that fewer than 1% of workspaces are affected, and that it revoked exposed Notion API keys found in affected user messages on November 11.
Notion’s updated security notice says Fireworks provided it on November 8 with a dataset that included Notion AI chat transcripts used for Insights, a feature that gives workspace administrators information about how their teams use AI. Notion says most affected transcripts were not attributable: they did not identify the person who wrote them or the workspace they came from, and did not contain tool-call results. That does not mean the content was necessarily harmless. Notion defines a transcript as model input or output written to the chat, which may include sensitive information entered by a user.
Notion says it used Fireworks for Insights classification jobs and also as a general inference provider for open-weight models in its product. The company identifies the exposed transcripts as coming from the Insights-related dataset, not from every use of Notion AI. It says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless that material was used as an input in a Notion AI chat transcript. Notion says no other Notion features were affected.
On November 11, Notion says it revoked exposed Notion API keys found in affected user messages. The company advises affected customers to treat the data as exposed, review it under its Security incident review guidance, and rotate passwords, API keys or other credentials that may have been pasted into Notion AI during the incident. Notion says it has not identified a workspace as affected if neither the workspace owner nor another user has received a notice from the company.
Notion AI chats included in breach despite zero retention
Notion says a dataset accessed in the Fireworks AI breach included some chat transcripts used for Insights. The finding raises questions about vendor retention and what users may have entered into AI chats.
What the dataset included
Notion says the exposed transcripts were tied to Insights, not every use of Notion AI.
Insights chat transcripts
Model inputs or outputs written in chat may contain sensitive information.
Many were unattributable
Most did not identify a person or workspace and lacked tool-call results; that does not establish the content was harmless.
Other product features
Notion says AI Meeting Notes and other features were not affected, unless meeting material was used as chat input.
What remains unclear
Published statements do not resolve how the retained dataset relates to Fireworks’ service categories.
What affected customers can do
Notion advises customers who received an affected-workspace notice to review relevant chats.
Follow Notion’s Security incident review guidance and look for sensitive material.
Change passwords, API keys or other credentials entered into Notion AI during the incident.
Notion says it has not identified a workspace as affected if no owner or user received a notice.
What the exposed chats could contain
The incident matters because an AI chat transcript can contain more than routine prompts. Users may enter customer names, contract details or credentials, and Notion says the specific inputs and outputs in the affected data may include sensitive information. The fact that many transcripts could not be linked to a named user or workspace does not establish that their contents were non-sensitive.
The breach also raises a practical question for organizations that rely on zero data retention (ZDR) assurances. Notion says its agreement with Fireworks promised zero retention, yet its investigation found that data from the endpoints it used had been retained. The company has not said what system held the data or how long it remained there, limiting what customers can conclude about the scope and handling of their information.
For affected workspaces, the immediate issue is not only whether chat text was accessed, but whether it contained information that now needs to be changed or otherwise handled as exposed. Notion’s advice to review transcripts and rotate credentials reflects that risk; it does not mean every affected chat contained secrets or that every credential was misused.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Jackery Explorer 1000 v2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
How Notion used Fireworks
Notion’s notice describes two Fireworks roles: processing for Insights classification and serving as an inference provider for open-weight models in Notion’s product. The company says the disclosed chat transcripts were tied to Insights. It also explains that its ZDR commitment for live requests sent to model vendors does not cover every feature that retains data to operate, naming chat history and Insights as examples.
Notion says Fireworks had made a contractual ZDR commitment for its use of the platform. In its own bulletin, last updated November 9, Fireworks said it had not detected an impact to Inference, Training SDK and Nexus, which it described as ZDR by default, while listing datasets among information accessed for certain customers. Those statements do not identify the Fireworks system involved in retaining Notion’s data, and the published information does not resolve the apparent discrepancy.
According to Notion’s timeline, Fireworks first notified it on November 2 that a small set of data had been accessed; Notion initially understood that data to be synthetic testing data. On November 3, Notion says it disconnected its systems from Fireworks, deleted its data in the Fireworks system, stopped communications between the companies’ systems and halted training runs. Notion subsequently updated its advisory on November 10 and 11 to include the chat-transcript finding.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion
What the breach notice leaves open
Notion has not identified which Fireworks system retained the data, why it was retained, or how long it remained there. The companies have also not published a count of affected people or a detailed breakdown of how many transcripts were in the accessed dataset. Notion gives the affected share as fewer than 1% of workspaces, but does not provide a total number in the notice summarized here.
It is also unclear whether other Fireworks customers experienced a similar retention issue. Fireworks’ bulletin refers to data accessed for certain customers and says it did not detect an impact to specific services it describes as ZDR by default. The available statements do not establish whether those services were involved in Notion’s case or explain how the retained dataset relates to Fireworks’ service categories.
Notion says most affected transcripts were unattributable, but the full contents and sensitivity of each transcript are not specified publicly. The companies have not reported whether attackers used any exposed credentials or whether the data was further shared. Those points should not be treated as confirmed either way.
Notion’s vendor review and customer steps
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and ZDR policies. The company has not given a completion date or described what changes may follow the review. Further updates from Notion or Fireworks may clarify the affected system, retention period and whether the same issue reached other customers.
Customers who receive an affected-workspace notice should follow Notion’s Security incident review guidance and examine relevant AI chats for sensitive material. Notion advises rotating any passwords, API keys or other credentials entered into Notion AI during the incident. The company says it revoked exposed Notion API keys found in affected messages on November 11; that action does not by itself address other credentials users may have entered.
For now, the scope remains based on Notion’s notice: fewer than 1% of workspaces, with no public count of affected individuals. Workspace owners can check for direct communication from Notion, while further reporting should distinguish the confirmed inclusion of chat transcripts from the unresolved questions about retention and the exact data exposed.
Key Questions
What Notion data was included in the breached dataset?
Notion says the dataset accessed by attackers included Notion AI chat transcripts used for the Insights feature. The company says most affected transcripts were not labeled with the author or workspace and did not include tool-call results.How many Notion workspaces are affected?
Notion says fewer than 1% of workspaces are affected. It has not published a total count of affected workspaces or people in the notice described here.Does zero data retention mean Notion AI chats are never stored?
Notion says its ZDR commitment for requests to model vendors does not cover features that need stored data, including chat history and Insights. It also says Fireworks had made a contractual ZDR commitment, but its investigation found data had been retained from the endpoints Notion used.What should users in an affected workspace do?
Notion advises affected customers to treat the data as exposed, review it using its Security incident review guidance, and rotate passwords, API keys or other credentials that were entered into Notion AI during the incident.What remains unknown about the Fireworks breach?
The companies have not said which Fireworks system retained Notion’s data, how long it was stored, how many people were affected, or whether other Fireworks customers had a similar issue. Notion also has not reported whether exposed credentials were misused.Source: ThorstenMeyerAI.com
