Notion says a vendor breach exposed AI chat transcripts

Notion says a breach at its vendor Fireworks AI exposed Notion AI chat transcripts in fewer than 1 percent of workspaces. The company published the advisory on November 9 and says it has contacted the workspace owners it has identified. If a workspace has not received a notice, Notion says it has not identified that workspace as affected, and no action is needed for now. The investigation is still open.

Notion says the chats were not labeled with who wrote them or which workspace they came from. The transcripts came from Insights, a feature that let administrators see how a team used AI. Notion says the vast majority were unattributable, which means they were not labeled with a person or a workspace and did not include tool-call results. It says nothing else in the dataset ties a chat to a workspace, a user, or a company. No other Notion feature was affected.

The first notice looked like test data. A later one did not. Notion says Fireworks told it on the evening of November 2 that malicious actors had accessed a small set of data. That set was synthetic test data, not customer chats. By the morning of November 3, Notion says it had disconnected from Fireworks, deleted its data there, and stopped all traffic to the vendor. On November 6, Fireworks said customer data may have been accessed. On November 8, it confirmed a new dataset. That set held the Insights transcripts.

Insights is off, and open-weight models no longer run through Fireworks. Notion says it used Fireworks to classify AI usage for Insights and to serve open-weight models. Both uses have stopped. Affected customers can review the exposed chats inside the workspace, using instructions sent by email. Notion says they should treat the data as exposed, and rotate any password, API key, or other credential pasted into Notion AI during the incident.