Fireworks AI's Breach Reached Notion's AI Chat Transcripts, and the API Keys Users Pasted Into Them
Updated Nov. 13: Notion confirmed that the Fireworks AI breach exposed Notion AI chat transcripts used for its Insights feature, affecting fewer than 1% of its workspaces; most chats were not labelled with a user or workspace. Notion has revoked exposed Notion API keys found in the chats, reported third-party keys to their issuers, disabled Insights and stopped serving open-weight models through Fireworks. Earlier: Fireworks said on November 9 that attackers who breached a third-party cloud host reached its development machines, exposing billing data and, for some customers, datasets and incomplete model weights, in its second incident in weeks.
Updated November 13, 2026: Notion has confirmed that the Fireworks breach exposed Notion AI chat transcripts from a small share of its workspaces, and is now chasing API keys that users pasted into those chats. The new section directly below covers it; the November 11 report follows unchanged.
November 13: Notion's chats were in the data#
The first named casualty is a customer's customers. Notion said Fireworks' dataset, which it received on November 8, included Notion AI chat transcripts used for its Insights feature, which shows workspace administrators how their teams use AI. Fewer than 1% of Notion workspaces were affected, Notion says, and for the vast majority of them the chats were "unattributable": not labelled with who wrote them or which workspace they came from, and without tool-call results.
Notion's timeline shows how the picture changed. Fireworks first told it on November 2 that only synthetic test data had been accessed; Notion cut its systems off from Fireworks by November 3 and deleted its data there on November 4. On November 6, Fireworks said customer data may have been accessed, and it confirmed the final dataset on November 8. Notion contacted affected customers on November 9, revoked exposed Notion API keys found in the chats on November 11, and on November 12 reported third-party API keys found in them to the vendors that issued them. It has disabled Insights, stopped serving open-weight models through Fireworks, and tells affected users to treat the data as exposed and rotate any credentials they pasted into Notion AI.
Notion also says in a FAQ that Fireworks had contractually committed to zero data retention for Notion data, BleepingComputer reported. Credentials are what the attackers Fireworks describes are after: they sell stolen access to language models, and keys taken in the Railway breach ran up about $740,000 in unauthorized AI usage, Railway estimates.
Limits of the November 13 update#
- Notion has not said how many workspaces or users were affected beyond "<1%", and TechCrunch described the share as "around 1%."
- Notion's statement that the transcripts were mostly unattributable is its own assessment; text inside a chat can still identify a person or company.
- We read the zero-data-retention detail in BleepingComputer's account, not in Notion's FAQ.
The pitch for fine-tuning open models is that a company keeps its own data and its own model. Fireworks' latest disclosure shows the other side of that pitch: the proprietary datasets and half-trained weights have to sit somewhere, and at Fireworks some of them were reached by attackers.
What Fireworks disclosed#
Fireworks, which runs and fine-tunes open models for businesses, updated its security bulletin on November 9. Its first notice, on October 9, said only Fireworks-stored secrets, such as those used in evaluation jobs, were known to have been accessed. Since then, the company said, it has found impacts to account and billing information, and, "for a limited set of accounts," to secrets, datasets and incomplete models.
The new access came through a supplier. A third-party cloud provider that hosted Fireworks' research machines suffered a security incident on October 23. On October 24, the attacker used it to reach Fireworks development machines and run an unauthorised workload that led to further customer data impact. Fireworks says it detected the activity the same day and has not seen further evidence of successful access to the platform customers use since October 25.
Exposed data, according to Fireworks, includes resource metadata, billing information such as addresses, invoices, balances and credit usage, and for certain customers a subset of incomplete model weights and datasets. Fireworks says it does not store payment card numbers, and that it has detected no impact to its inference, Training SDK and Nexus products, which do not retain data by default.
Fireworks says the evidence points to a financially motivated group that sells stolen access to large language models to illicit routing gateways, a practice known as LLMjacking. It is working with Palo Alto Networks' Unit 42, has rotated credentials, isolated affected systems and, for now, disabled self-serve dataset uploads and downloads for batch inference and dataset-based training. BleepingComputer's account matches the bulletin.
Customers' reaction#
Fireworks has roughly 10,000 enterprise customers, Forbes reported. Two customers told Forbes they had already substantially moved their business off Fireworks, one describing a series of "very bad hacks" and criticising the company's communication; two others said they were unaware of any hacks. A Fireworks spokesperson told Bloomberg Law the company is "actively working with our customers to manage the incident, including Notion, Cursor and others."
Limits#
- The scope of the breach is Fireworks' own account, and its investigation is continuing; the company says it may find more.
- Fireworks has not said how many customers had datasets or model weights accessed, or which ones.
- We read Forbes' report through a syndicated copy and could see only the opening of Bloomberg Law's paywalled article.
- Fireworks first gave notice on October 9 and published this update on November 9.