Notion has confirmed that AI chat transcripts stored under its Insights feature were exposed during a Fireworks AI breach—affecting fewer than 1% of customer workspaces. The incident is limited to Insights-related conversations; no other Notion features or systems were compromised. Customers with no notification are not believed to be affected, though investigations are still ongoing and may expand disclosures.
What Unfolded
The security concern began when Notion was alerted by Fireworks AI on the evening of November 2, 2026, following detection of unauthorized access to a testing dataset. By the morning of November 3, Notion had severed ties with Fireworks, removed all related data, and ceased operations with the vendor. Initial assessments reached a turning point on November 6, when Fireworks suggested customer data may have been compromised—prompting a fresh investigation. That probe confirmed on November 8 that transcripts from customer chats via the Insights tool were indeed exposed. Previously, Notion had maintained that no customer data had been involved in the incident.
What Was Exposed—and What Wasn’t
The breach pertains only to Insights transcripts: the content of AI chat conversations, which Notion used Fireworks AI to classify and process with open-weight models. The transcripts were mostly “unattributable,” meaning they lacked tags linking them to specific authors or workspaces and did not include calls to external tools. However, while metadata linking users or companies was stripped, Notion points out that chats themselves could still contain sensitive information users typed in—revealing names, details, or business secrets. Notion has paused Insights and shut off any service using Fireworks models until the investigation concludes.
Customers who were affected have been contacted, and are instructed to review conversation content within their workspace. Notion is also advising those impacted to reset any passwords, API keys, or credentials that might have been entered into AI chats during the exposure period. For those not notified, no action is required at this time.
The exposure is tied to a wider Fireworks AI breach that included leaks of customer datasets, incomplete model weights, and numerous customer records. But Notion’s confirmed issue is limited to its own subset of chat transcripts processed via Insights—not the full breadth of the Fireworks incident.
Notion’s advisory points out that all actionable voice was to treat the exposed transcripts as compromised, even when stripped of identifying metadata. It has committed to keeping customers up to date through bulletins until the situation is fully resolved.
Estimated reading time: 3 minutes
Analysis: This breach highlights the complexity and risk of relying on third-party AI vendors—especially for services that handle user-generated content. Notion’s case is a cautionary tale about the boundaries of “unattributable” data: even without clear ownership labels, user input can still reveal identity or sensitive matters. Going forward, companies using AI tools that process user conversations should enforce stricter data labeling, sandboxing, and encryption policies—and consider maintaining full control over sensitive transcripts rather than outsourcing to external providers.
