Notion has disclosed that a security incident at its AI vendor Fireworks AI may have exposed some customers' Notion AI chat transcripts, in an event that affected fewer than 1% of Notion workspaces. In a notice published in its help center, the productivity company said the exposed transcripts were "unattributable" — not labeled with who wrote them or which workspace they came from — and contained no tool call results, meaning no information in the data tied individual chats back to a specific user, workspace, or company.
The disclosure is the latest turn in a breach that Fireworks AI, one of the most widely used independent AI inference platforms, has been tracking in public security bulletins since October 2026 — and it offers a rare detailed look at how an attack on AI infrastructure actually unfolds. For more context on this story, see our ongoing breaking AI news.
What Fireworks AI has confirmed
Fireworks AI published its original security bulletin on October 9, 2026, notifying law enforcement and engaging Palo Alto Networks' Unit 42 to conduct forensic analysis. At that stage, the company said only Fireworks-stored secrets used in evaluation jobs were known to have been accessed.
The picture widened considerably in the follow-up bulletin, last updated November 9. Fireworks says it subsequently discovered impacts to account and billing information, and — for a limited set of accounts — to secrets, datasets, and incomplete models. The company attributes the attack to a financially motivated cybercriminal group engaged in "LLMJacking": stealing access to large language models so the tokens can be resold through illicit routing gateways. That trade has grown prominent enough that Google Threat Intelligence Group and Mandiant published a joint blog post on the rise of LLMJacking on November 2.
The incident also escalated through a supply chain of its own. According to Fireworks, a third-party cloud provider hosting its research and development machines suffered its own security incident on October 23. The next day, an unauthorized third party used that foothold to reach Fireworks development machines and run an unauthorized workload, causing additional customer data impact. Fireworks says it detected the activity the same day and took remediation measures, and that as of October 25 it has not detected further evidence of successful unauthorized access on the platform customers use.
The categories of data the affected internal system could expose, per Fireworks: resource metadata such as identifiers and descriptions; billing information including billing addresses, invoice and payment history, and account balances — with payment card numbers not stored by Fireworks and therefore not impacted; and, for certain customers, model weights and datasets.
How Notion was caught in the blast radius
Notion used Fireworks for two things: classification jobs powering a feature called Insights, which helps customers understand their own AI usage, and as a general inference provider serving open-weight models inside the product.
The company says it learned of potential incidents from Fireworks earlier this month and shut down all connections to Fireworks' systems as a precaution. On November 6, Fireworks notified Notion that malicious actors may have accessed customer data; two days later, on November 8, Fireworks confirmed the dataset, which Notion's analysis showed included the unattributable Notion AI chat transcripts used for the Insights feature.
Notion has disabled the Insights feature while it investigates and is no longer serving open-weight models through Fireworks. No other workspace data is affected, according to the notice.
What affected users should do
Notion says it has contacted the owners of every affected workspace, and that customers who have not heard from the company are not affected and need take no action. Workspace owners can review the affected data inside Notion via the sidebar help menu, using the desktop app or web browser — the review tool is not accessible on mobile.
Enterprise-plan owners get more: a CSV of the workspace's affected data, plus an annotated version with metadata identifying which user was associated with each chat transcript. Notion stresses that those added annotations were not part of the exposed data — they were produced afterward to help affected organizations run their own impact analysis.
Why this incident matters beyond Notion
The episode is a case study in AI supply-chain risk. Companies increasingly embed third-party inference providers — vendors that run open-weight or specialized models on their behalf — into consumer products, and a breach at the infrastructure layer can quietly expose customer interaction data that the product company itself never stored.
It is also a high-profile demonstration of the LLMJacking pattern that Google Threat Intelligence and Mandiant flagged: attackers who monetize stolen AI infrastructure by reselling model access through shadow gateways, rather than holding data for ransom in the classic pattern. As enterprises pour workloads onto AI inference platforms, the security of those platforms — and of the cloud providers behind them — is becoming a first-order enterprise risk, not a footnote.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
