Fireworks AI breach exposes Notion AI chat logs to intruders

Fireworks AI, which gives companies the infrastructure to train and run AI models, suffered two intrusions in October 2026, and one of them reaches the collaboration platform Notion. According to iThome, some Notion AI conversation logs were accessed without authorization; Notion says about 1% of its workspaces are affected and that the customers concerned have been notified. Notion stresses that its own systems were not breached and that its other features are unaffected.

The picture is still incomplete: according to The Register, neither Fireworks nor Notion has published how many customers in total were hit by the two intrusions. The real scale is therefore unknown for now.

Two intrusions at Fireworks in October

According to The Register and iThome, Fireworks detected unauthorized use of internal credentials on October 6 and disclosed it on October 9. The attackers had obtained environment variables from evaluation jobs, including API keys and tokens belonging to some customers. At the time, the company said it had found no evidence of access to models, datasets, training data or inference traffic.

A second attack took place on October 24. Fireworks explains that a third-party cloud provider hosting its research and development machines had suffered a security incident the day before, on October 23, and that the attackers used it to get into development machines and run an unauthorized workload. Fireworks suspects financially motivated criminals tied to LLMjacking, meaning the resale of unauthorized access to AI models. That is the company's suspicion, not an established attribution.

The update published on November 9 widens the scope considerably. The affected data includes:

• resource metadata (identifiers, display names, descriptions, creation times);
• billing information: billing and shipping addresses, invoice and payment histories, account balances;
• for some customers, datasets and incomplete model weights.

Fireworks states that it does not store payment card numbers. According to iThome, its Inference, Training SDK and Nexus services, which run with zero data retention by default, show no sign of being affected so far. CEO Lin Qiao told The Register that the attackers do not appear to be after model weights, since most downloads were partial and stopped. Fireworks brought in Palo Alto Networks' Unit 42 team, replaced credentials, isolated affected systems, restricted network access and suspended self-serve uploads and downloads for batch inference and dataset training.

What Notion found

Notion used Fireworks for the conversation classification behind its Insights feature, which helps companies analyze how Notion AI is used, and to run open-weight models. According to iThome, Notion was first alerted on November 2; the initial analysis concluded the accessed data was synthetic test data with no customer data. Fireworks sent a new alert on November 6, and only on November 8 did Notion confirm that the data included AI conversation logs, with the models' inputs and outputs.

Notion had already cut its connection to Fireworks on November 3 and deleted the data stored there. It has disabled Insights and no longer uses Fireworks for open-weight model inference. In an email quoted by The Register and shared by Render CEO Anurag Goel, Notion writes that some “unattributable” chat sessions may have been exposed and that nothing else in the workspace is affected.

Beyond what's in the chat transcript itself, there's no information tying the chat back to your workspace, users, or company.

That is the sensitive point: while most transcripts carry no user or workspace identifier, a conversation can itself contain identifying or sensitive information, as Reddit users pointed out according to The Register. Notion lets affected workspaces view the data and urges users who typed passwords or API keys into a chat to change them quickly.

According to Bloomberg, relayed by The Register, Fireworks is also working with other customers, including Cursor and Harvey, to assess the impact. The outcome of those assessments was not known at the time of writing.

What this changes for a business

For a company that uses Notion AI or any tool built on models hosted by a subcontractor, the lesson is concrete: your conversations with AI may pass through a provider whose name you do not know. Ask your software vendors for the list of their AI subprocessors and their data retention policy, checking in particular for zero retention by default.

Three immediate steps: check whether your workspace received a notice from Notion, change any API key or password already pasted into an AI chat, and assess with whoever handles personal data whether personal information appeared in those exchanges, to decide on the internal steps to follow. In the longer run, a clear rule, never paste secrets or personal data into an AI conversation, beats counting on deletion after the fact.