Notion has disclosed that a security incident at Fireworks AI, a third-party inference provider it used, may have exposed Notion AI chat transcripts from fewer than 1% of workspaces. Notion used Fireworks for Insights classification jobs and as a general inference provider for open-weight models.
According to Notion's help center notice, the company learned of potential incidents at Fireworks earlier in November and, on November 3, disconnected from Fireworks, deleted its data in the Fireworks system and stopped sending traffic there. On November 6 Fireworks notified Notion that malicious actors may have accessed potential customer data, and on November 8 Fireworks confirmed the affected dataset.
Notion says the exposed data consists of some Notion AI chat transcripts used for Insights. The transcripts were unattributable, meaning they were not labeled with an author or workspace, and did not include tool call results. Notion states that no other workspace data is affected. It has disabled Insights while it investigates, stopped serving open-weight models through Fireworks, halted all training runs and contacted owners of affected workspaces.
Affected workspace owners can review the data from the Notion sidebar under Help, then Security incident review, on a desktop browser with the latest app version. Notion advises treating the data as exposed and immediately rotating any passwords, API keys or other credentials that were pasted into Notion AI. Workspaces that have not been contacted are not affected, according to Notion.
Fireworks had separately published a bulletin on an October 2026 incident in which an unauthorized party used internal Fireworks credentials, identified on October 6, and accessed environment variables used in evaluation jobs in a limited number of customer accounts. For companies building on AI vendors, the episode shows how prompts and transcripts sent to a downstream inference provider become part of the data exposure surface. Sources: Notion help center, Fireworks AI security bulletin.