Fireworks Breach Spills Notion AI Transcripts and Customer Datasets

Key Takeaways

• Fireworks AI updated its October breach notice on November 9, 2026, adding secrets, datasets and incomplete model weights for some customers.
• Notion said on November 10 that AI transcripts used by its Insights feature were exposed for fewer than 1% of workspaces.
• Notion disabled Insights, stopped routing open-weight models through Fireworks, and revoked exposed API keys on November 11.
• Fireworks was first named in the Black October wave of attacks on AI developer platforms.

An Inference Provider Breach Reaches Its Customers' Users

Fireworks AI, a hosted inference platform, said attackers entered its development environment through a compromised third-party cloud provider. BleepingComputer reported that the breach reached Notion customers' AI chat transcripts, a clear case of AI supply chain exposure. The update also adds secrets, datasets and partial model weights to the list of affected Fireworks data.

What We Know

Fireworks first disclosed the incident in October. Its November 9 update lists account, billing and resource metadata, and for some customers stored secrets, datasets and incomplete model weights.

Notion's advisory describes a slower path to clarity. Fireworks notified Notion on the night of November 2, initially describing the affected data as synthetic test data. Notion disconnected the integration by November 3. Fireworks confirmed on November 8 that the dataset held real transcripts.

The exposed data came from Notion's Insights feature, which processed AI conversations for analytics. Fewer than 1% of workspaces were affected. Most transcripts carried no user or workspace labels, but their content could still be sensitive. On November 11, Notion revoked Notion API keys found in the exposed messages.

Fireworks appeared in the Northflank entry on the PointGuard AI Security Incident Tracker, which tracked the October attacks on AI developer platforms. Notion has notified affected workspace owners directly.

What Happened

The attackers did not breach Notion. They breached a provider that one of Notion's vendors relied on, then reached data that Notion had sent to that vendor for AI processing.

That chain has three links: a third-party cloud provider, the Fireworks development environment, and customer data stored there. Fireworks held datasets and transcripts that customers had shared for model evaluation and analytics, along with secrets those customers had configured.

For Notion, the exposed records were AI transcripts processed by Insights. Users typed some of those conversations with no expectation that a downstream inference vendor would keep them, and some contained API keys pasted into prompts.

The impact also reached model assets. Fireworks lists incomplete model weights among the data involved, which matters for customers who fine-tune proprietary models on the platform.

Notion responded by disabling Insights, removing Fireworks from its open-weight model routing, and revoking exposed keys. Neither company has said that all inference traffic or all workspaces were affected.

Why It Matters

Most enterprises now send prompts, documents and datasets to several AI vendors at once, often through SaaS products that choose their own inference providers. Each hop extends the data's lifetime and the number of places it can leak.

This incident shows how hard that chain is to see. Notion's users had no direct relationship with Fireworks, and Notion itself first heard the data was synthetic. Accurate scoping took six days.

Prompts are also a credential store nobody planned. Users paste API keys, connection strings and customer details into AI chats, and those transcripts are then retained for analytics, evaluation and debugging.

Security teams should map which AI subprocessors receive their data, ask how long transcripts and datasets are kept, and rotate any credentials that appear in AI conversations. Contracts should require timely, accurate breach notice from every inference provider in the chain. Incident response plans should include steps for a breach at a provider you do not contract with directly.

PointGuard AI Perspective

The Fireworks breach is a reminder that AI data protection cannot stop at the edge of the first application. Data moves from users to SaaS tools to inference providers, and every stop is a potential exposure point.

PointGuard AI Data Protection inspects prompts and responses in real time, detecting secrets, credentials and sensitive records before they leave the organization. If an API key never reaches a third-party transcript, it cannot be exposed when that third party is breached. Redaction policies can be tuned per data type and per destination.

Visibility into the vendor chain is the second control. PointGuard AI Supply Chain Security builds an AI bill of materials covering models, inference providers and the services that call them. That inventory shows which vendors hold which data, so teams can scope impact in hours when a provider such as Fireworks reports an incident.

Routing model access through a single policy point also helps. When every request passes through a governed gateway, security teams can see which applications use which providers, block unapproved ones, and switch providers quickly, much as Notion did by pulling Fireworks from its routing.

The broader lesson is that AI vendor risk is data risk. Treat every inference provider as a place where your users' words may be stored.

Incident Scorecard Details

Total AISSI Score: 8.15/10

Criticality: 8, Private prompts, secrets, datasets and model weights were exposed. AISSI weighting: 25%

Propagation: 8, The breach passed from a cloud provider to an AI vendor to its customers. AISSI weighting: 20%

Exploitability: 8, Unauthorized access and customer data exposure are confirmed. AISSI weighting: 15%

Supply Chain: 9, A multi-vendor dependency chain sits at the center of the incident. AISSI weighting: 15%

Business Impact: 8, Confirmed customer exposure, key revocation and a suspended AI feature. AISSI weighting: 25%

Sources

Third-Party Sources

• BleepingComputer: Notion says Fireworks breach exposed customer AI chat transcripts
• Notion: Security incident involving a third-party AI vendor

PointGuard AI Sources

• PointGuard AI Incident Tracker: Northflank Breach Caps Black October Run on AI Developer Keys
• PointGuard AI Data Protection
• PointGuard AI Supply Chain Security