🔍 Read the full analysis: Notion Says Fireworks Breach Exposed AI Chat Transcripts, Despite A Zero-Retention Promise on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says data accessed in the Fireworks AI breach included stored Notion AI chat transcripts used for its Insights feature. The company says fewer than 1% of Notion workspaces are affected and that Fireworks had promised zero data retention, but data was retained. Notion has revoked exposed API keys found in affected messages; the number of people affected and how long the data was retained remain unknown.
Notion says attackers who accessed data at AI provider Fireworks also accessed Notion AI chat transcripts used for the company’s Insights feature, adding a significant new detail to its account of the breach. Notion says fewer than 1% of workspaces are affected and that Fireworks had made a contractual commitment to zero data retention, but data from the endpoints Notion used was retained.
In an updated security advisory and help page, Notion said a dataset it received from Fireworks on November 8 included transcripts from Notion AI chats used for Insights, a feature that gives workspace administrators information about team AI use. Notion said the transcripts for the vast majority of affected workspaces were “unattributable”: they were not labeled with the author or workspace and did not include tool-call results.
That does not mean the chats contained no sensitive information. Notion defines a transcript as input to or output from the model that was written to the chat, and advises affected customers to examine the data because it may contain sensitive material. The company says AI Meeting Notes — including audio, transcripts and summaries — were not affected unless they were used as an input in a Notion AI chat transcript. It also says no other Notion features were affected.
Notion said it disconnected its systems from Fireworks on November 3, deleted data from the Fireworks system and stopped communications between the systems. On November 11, it said it had revoked exposed Notion API keys found in affected user messages. For any other passwords, API keys or credentials that may have been pasted into Notion AI during the incident, the company advises affected users to rotate them and treat the material as exposed.
Fireworks breach exposed Notion AI transcripts
Notion says data retained by AI provider Fireworks included chat transcripts used for its Insights feature, despite a contractual zero-retention commitment.
What was exposed
The disclosed transcripts were used to analyze team AI activity for Insights.
AI chat content
Inputs and outputs written to Notion AI chats may contain sensitive information.
Limited attribution
Most affected transcripts lacked author and workspace labels and tool-call results.
Other features
Meeting Notes were not affected unless used as chat input; Notion says no other features were affected.
The retention gap
Notion says the contractual promise covered inference requests, while stored data used for features such as Insights fell outside that scope.
- Fireworks committed to zero data retention for Notion’s use.
- Inference requests used to generate responses were covered.
- Stored requests and responses were sent for Insights analysis.
- Data from the endpoints Notion used was retained.
Response and user action
Notion disconnected from Fireworks, deleted data from its system and revoked exposed Notion API keys.
Workspace owners should examine the material for sensitive content.
Change passwords, API keys and other credentials pasted into Notion AI during the incident.
Follow up on sensitive chat material that may need protection.
What remains unclear
Public statements leave key details about the incident unresolved.
- Which Fireworks system retained the data, and why.
- How long the data remained there.
- How many people were affected and whether attackers accessed every transcript.
The Limits of Fireworks’ Retention Promise
The disclosure matters because the transcripts were present at a third-party provider despite Notion’s stated understanding that Fireworks would not retain data. Notion said Fireworks gave it a contractual zero-retention commitment, then added that its investigation found data had been retained from the endpoints it used. That makes this more than a question of which chat content was accessed: it also raises questions about how stored data was handled and whether contractual safeguards matched actual practice.
Notion’s explanation distinguishes live requests sent to model providers from information kept to support features. The company says its zero-retention commitments cover API requests used to generate responses, while stored data needed for features such as chat history and Insights falls outside that scope. For Insights, Notion said it sent stored Notion AI requests and responses to Fireworks for analysis. The breach therefore highlights that a zero-retention promise for inference requests may not cover every later use or processing path.
For affected organizations, the practical risk depends on what people included in chats. Notion says the records may contain sensitive inputs or outputs, including credentials. Workspace owners should review the affected data and decide whether information in it needs follow-up, while avoiding assumptions that transcripts were harmless merely because most were not labeled with a person or workspace.
Products Worth Considering
Samsung Odyssey OLED G5 27-Inch QHD Gaming Monitor
DJI Mini 4 Pro Fly More Combo with DJI RC 2
DJI Mini 3 Drone with DJI RC and 3-Axis Gimbal
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion said it used Fireworks for two purposes: classification jobs for Insights and as a general inference provider for open-weight models in its product. The newly described transcript exposure relates to Insights, rather than all Notion AI activity or every Fireworks service. Notion’s advisory says stored requests and responses were used for analysis for that feature.
The companies’ public accounts do not fully explain how Notion data came to be retained. Fireworks’ bulletin, last updated November 9 according to the source material, said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-retention by default. It also listed datasets among data accessed for certain customers. Notion’s later account says data was retained from the Fireworks endpoints it used. The published statements do not identify which system held Notion’s data or reconcile the descriptions.
Notion’s published timeline says Fireworks notified it on November 2 that a small set of data had been accessed by malicious actors; Notion initially understood that set to be synthetic testing data. Notion says it disconnected from Fireworks the following morning. The November 8 dataset and the November 10–11 updates supplied further details about the material and the response. BleepingComputer reported the transcript disclosure on November 11.
““Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.””
— Notion, in its updated security notice
What the Notices Do Not Explain
The public accounts do not say which Fireworks system retained the data, why it was retained, or how long it remained there. Notion has not given a count of affected people or a detailed breakdown of how many workspaces were involved. Its figure is that fewer than 1% of workspaces are affected; it does not specify the number of users represented by those workspaces.
It is also unclear whether other Fireworks customers had data retained in a similar way. Fireworks’ statement that it had not detected an impact to certain services does not, in the material available, explain the handling of Notion’s data or settle how the two companies’ descriptions fit together. The source material does not establish whether attackers accessed every transcript in the dataset or what specific sensitive information, if any, was present in individual records.
Notion says affected workspace owners or users should receive notice. It says that if neither the user nor the workspace owner has heard from the company, Notion has not identified that workspace as affected. That is Notion’s current identification status, not a public accounting of every record in Fireworks’ systems.
Notion’s Vendor Audit and User Review
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and retention policies. The company has not published a completion date for that review. Further detail from Notion or Fireworks about the affected systems, retention period and scope would help clarify how the data was handled.
Notion advises affected workspaces to review the exposed material under its Security incident review guidance and treat it as if it were exposed. Users should rotate credentials they entered into Notion AI during the incident, including API keys and passwords, and review other sensitive chat content for potential follow-up. Notion has not announced additional product changes or a new deadline in the available notice.
Key Questions
What information does Notion say was exposed?
Notion says the dataset accessed at Fireworks included Notion AI chat transcripts used for Insights. It says transcripts may include inputs and outputs written in chat and may contain sensitive information. The company says most affected transcripts were not labeled with an author or workspace.
How many Notion workspaces are affected?
Notion says fewer than 1% of workspaces are affected. It has not published a precise number of workspaces or people in the notice described here.
Does Notion say AI Meeting Notes were exposed?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless they were used as input in a Notion AI chat transcript. It also says no other Notion features were affected.
What should users in affected workspaces do?
Notion advises affected users to review the relevant data under its Security incident review guidance and treat it as exposed. Rotate any passwords, API keys or other credentials pasted into Notion AI during the incident.
Why did this happen despite a zero-retention commitment?
Notion says Fireworks had made a contractual zero-retention commitment but that its investigation found data had been retained from the endpoints Notion used. The companies have not publicly identified which system retained the data, for how long, or why.
Source: ThorstenMeyerAI.com
