🔍 Read the full analysis: Notion Says Fireworks Breach Exposed AI Chat Transcripts, Despite A Zero-Retention Promise on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says a dataset accessed in the Fireworks AI breach contained some Notion AI chat transcripts, affecting fewer than 1% of Notion workspaces. Notion says Fireworks had contractually committed to zero data retention, but data from the endpoints Notion used was retained; the system and retention period remain unknown.
Notion says a dataset accessed by attackers in the Fireworks AI breach included some Notion AI chat transcripts, and that data from the Fireworks endpoints it used had been retained despite a contractual zero-data-retention commitment. Notion estimates that fewer than 1% of its workspaces were affected and says it revoked exposed Notion API keys found in affected user messages on November 11.
Notion’s updated advisory says the exposed dataset, which Fireworks provided to the company on November 8, included transcripts from Notion AI chats used for the Insights feature. Insights gives workspace administrators information about how their teams use AI. Notion said most transcripts in the affected workspaces were “unattributable”: they were not labeled with the person who wrote them or the workspace they came from, and did not contain tool-call results.
That description does not mean the chat content was necessarily harmless. Notion defines a transcript as any input to or output from the model that was written to the chat. It advises affected customers to review the data because a prompt or response may contain sensitive information. Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless used as input in a Notion AI chat transcript; it says no other Notion features were affected.
Notion says it used Fireworks for Insights classification jobs and to provide inference for open-weight models within its product. The company says the exposed data came from the Insights-related use. On November 11, it also said it had revoked exposed Notion API keys found in affected user messages. It has not publicly specified how many individual users or transcripts were involved.
Notion AI chats exposedafter Fireworks breach
Notion says attackers accessed a dataset containing some Notion AI chat transcripts, despite Fireworks’ contractual zero-retention commitment.
What was exposed
The dataset included transcripts from Notion AI chats used for Insights.
Prompts and responses
Transcripts may contain sensitive information entered into an AI chat.
Often unlabeled
Most lacked user or workspace labels. That does not mean the content was harmless.
Insights-related chats
Notion says AI Meeting Notes and other features were not affected, except when used as chat input.
The retention gap
Notion says Fireworks had committed to zero retention, yet data from the endpoints Notion used was retained.
- Fireworks made a contractual zero-retention commitment.
- The exposed transcripts came from Insights-related use.
- Which system retained the data and for how long.
- Why retention occurred, or whether other Fireworks customers were affected.
What affected customers can do
Notion recommends reviewing the data and treating any included credentials as exposed.
Workspace owners should use Notion’s Security incident review guidance.
Change passwords, API keys, or other credentials pasted into Notion AI.
Notion says it has not identified a workspace as affected if neither the user nor its owner has been contacted.
What the Retained Chats Could Contain
The disclosure matters because the incident concerns stored prompts and responses, not just data sent to a model to generate a live answer. Users may include names, contract details, credentials or other confidential material in an AI chat. Notion says the content varies and recommends that affected workspaces examine their data rather than assume the transcripts were non-sensitive.
The notice also highlights a distinction relevant to companies buying AI services: a provider’s zero-retention terms for inference requests may not cover information stored for product features such as chat history or analytics. In this case, Notion says Fireworks had made a contractual zero-retention commitment for its use of the platform, but that data was nevertheless retained from the endpoints Notion used. The published information does not explain how that retention occurred.
For affected customers, Notion recommends treating the data as exposed, reviewing the incident under its Security incident review guidance, and rotating passwords, API keys and other credentials that were pasted into Notion AI during the incident. The company says it is auditing critical vendors and data processors for data-minimization practices, including retention policies.
Products Worth Considering
LG UltraGear evo 52-Inch 5K2K 240Hz Curved Gaming Monitor
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, White Silver
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion’s advisory describes two uses of Fireworks: classification jobs for Insights and general inference for open-weight models in Notion’s product. Notion says the transcripts in the breached dataset related to Insights, where stored requests and responses from Notion AI use were analyzed. That is distinct from a simple live request to a model provider.
Notion’s FAQ says its zero-retention commitments for third-party model requests apply to requests sent to generate Notion AI responses. It says that commitment was not intended to cover use cases requiring stored data, including chat history and Insights. Separately, Notion says Fireworks had contractually committed to zero retention for Notion’s use of its platform, and that its investigation found data had been retained from the endpoints involved.
Fireworks’ own bulletin, last updated November 9 according to the supplied reporting, said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-retention by default. The bulletin also listed datasets among data accessed for certain customers. The two companies’ statements do not identify which system retained Notion’s data or explain the apparent gap between the commitment and the retention.
““Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.””
— Notion, in its updated security advisory
Which System Retained the Data
The public notices do not identify which Fireworks system retained the data, how long it was kept, or why retention occurred despite the contractual commitment described by Notion. Fireworks’ statement about services that are zero-retention by default does not answer those questions for the endpoints Notion used.
Notion gives an estimate of fewer than 1% of workspaces, but has not disclosed the number of affected people, the total number of transcripts or the amount of sensitive information in them. It also remains unclear whether the same retention issue affected other Fireworks customers. The available statements do not establish that it did.
Notion’s description that most transcripts were unattributable is limited: it says the records lacked labels identifying users or workspaces, not that the content itself could not reveal identities or confidential details. The company has urged affected customers to review the material for that reason.
Customer Reviews and Vendor Audit
Notion says affected workspace owners should review the data using its Security incident review guidance and rotate any passwords, API keys or other credentials entered in Notion AI during the incident. The company says it revoked exposed Notion API keys found in affected messages on November 11. Users who have not heard from Notion should not infer from the public notice alone that their content was exposed; Notion says it has not identified their workspace as affected if neither they nor their workspace owner has been contacted.
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. Further detail from Notion or Fireworks would be needed to establish how the data was retained, how long it remained available, and whether the issue extended beyond Notion. No further public finding or date for a completed audit is specified in the supplied material.
Key Questions
What information does Notion say was exposed?
Notion says the dataset accessed in the Fireworks breach included Notion AI chat transcripts used for Insights. It defines transcripts as model inputs or outputs written in the chat and warns that they may contain sensitive information.
How many Notion customers were affected?
Notion estimates that fewer than 1% of workspaces were affected. It has not published a count of affected users or transcripts in the supplied notice.
Does Notion say AI Meeting Notes were exposed?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless that material was used as input in a Notion AI chat transcript.
What should affected workspace owners do?
Notion advises treating the data as exposed, reviewing it under its Security incident review guidance, and rotating passwords, API keys or other credentials pasted into Notion AI during the incident.
Why were transcripts retained despite a zero-retention commitment?
That remains unclear. Notion says Fireworks contractually committed to zero retention for its use of the platform, but its investigation found data retained from the endpoints it used. Neither company’s published statements identify the system or explain the cause.
Source: ThorstenMeyerAI.com
