Notion says a security incident at Fireworks AI, a company that ran AI models for it, may have exposed some Notion AI chat sessions. Notion used Fireworks for classification jobs behind its Insights feature, as an inference provider for open-weight models, and for training experiments. Notion says fewer than 1% of workspaces may have been affected.
Timeline, per Notion: after learning of possible incidents, Notion disconnected all systems from Fireworks by 3 November, deleted its data there and stopped sending traffic. On 6 November Fireworks told Notion that attackers may have accessed customer data, and on 8 November it confirmed the dataset. Notion says the exposed chats were used for Insights, were not labelled with the author or workspace and did not include tool call results, and that no other workspace data is affected. Reddit users quoted by The Register point out that the chat text itself can still contain identifying details.
Fireworks was hit twice. According to The Register, Fireworks found misuse of internal credentials on 6 October (API keys and tokens of some customers were exposed). In a second incident, a third-party cloud provider hosting its R&D machines was compromised on 23 October, and the next day attackers reached Fireworks development systems. They accessed resource metadata, billing details (no card numbers) and, for some customers, incomplete model weights and datasets. Fireworks suspects financially motivated "LLMjacking" criminals; CEO Lin Qiao said "attackers are not after weights" and "most downloads were partial and stopped". Bloomberg reports Fireworks is also assessing impact with Cursor and Harvey. Fireworks has not said how many customers were affected.
Notion has disabled Insights during the investigation, stopped serving open-weight models through Fireworks, halted training runs and contacted owners of affected workspaces. If you were not contacted, Notion says your workspace is not affected.
