Notion AI Chat Transcripts Exposed in Fireworks Breach: What Notion Says

Notion told affected customers that data taken in the Fireworks AI breach included Notion AI chat transcripts, according to the full text of a customer email posted on Hacker News on November 10, 2026. Notion describes the exposure as hitting fewer than 1% of workspaces, says Insights and open-weight model routing through Fireworks are disabled, and asks teams to rotate secrets that might have appeared in AI chats.

This is the first product-specific description of what sat inside Fireworks-hosted datasets — beyond billing rows and partial weights that Fireworks documented on November 9. If your company runs Notion AI alongside coding agents, treat it as a supplier-chain privacy case, not a separate Notion SaaS zero-day.

TL;DR

Agents that act on your behalf need rules. See how explainx helps secure your agents →

What the quoted Notion email says

The HN post titled "Tell HN: Notion AI chat sessions have been exposed via Fireworks AI hack" pastes an email Notion sent to at least one workspace. We treat it as primary wording from Notion to customers, relayed by the poster, until Notion publishes the same language on its trust site.

Core claims in that text:

1. Vendor incident. Notion frames the event as a security incident at Fireworks AI, with a pointer to Fireworks official updates.
2. Scope. "Less than 1%" of Notion workspaces "may have been affected."
3. Data type. "Unattributable chat sessions with Notion AI" — defined as chats without user or workspace labels in the dataset, and without tool-call results.
4. Use case. Fireworks ran classification jobs for Insights (customer AI usage analytics) and served open-weight models inside Notion.
5. Timeline in the email. Notion says it learned of potential issues earlier in November, shut all Fireworks connections, received Fireworks notice on November 6, and on November 8 Fireworks confirmed a dataset that included the Insights transcripts.
6. User steps. Notion offers a secure in-workspace retrieval path for impacted data (redacted in the HN paste) and urges rotation if anyone pasted passwords, API keys, or credentials into Notion AI chats.

The poster adds a critical footnote: "I downloaded the dataset and it's a full chat for me." That contradicts the "unattributable" label in the same thread — treat attribution as disputed between Notion's email framing and one customer's experience until Notion or Fireworks publish technical forensic detail.

How this fits the Fireworks incident timeline

Our Fireworks breach update tracked:

• October 9 initial credential incident.
• October 23–24 cloud-provider path into R&D machines.
• November 9 bulletin expansion to billing addresses, invoice history, and incomplete weights/datasets for a limited customer set.

Bloomberg Law reported a Fireworks spokesperson naming Notion among customers receiving support — vendor attribution, not a description of chat content.

The Notion email, if authentic, explains why Notion appeared on that list: Insights classification and in-product open-weight inference created transcript-shaped artifacts on Fireworks infrastructure. That is different from exfiltrating entire Notion databases or page trees, which the email explicitly denies.

For LLMjacking context, see Google GTIG research on stolen inference keys and the October platform breach wave — financially motivated actors target inference hosts because keys and customer fine-tunes resale well.

Beads escaping a cracked vessel illustrating third-party AI vendor data spillover

Why "unattributable" still matters for risk teams

Notion's email stresses that leaked chats lacked workspace metadata and tool results. Compliance officers may read that as lower re-identification risk. Security engineers should still assume:

• Secrets in chat text do not need attribution to hurt you. A pasted AWS key in a transcript is actionable even if the header lacks your company name.
• Combined datasets elsewhere in the Fireworks incident might include billing emails or API keys that correlate tenants. Fireworks' bulletin already added billing and invoice history for some accounts.
• User dispute on HN suggests at least one recipient saw a fully attributable conversation. Do not treat "unattributable" as a guarantee without your own notification letter.

If you run MCP-connected notebooks or Codex plugins tied to Notion, map which integrations copy content into inference vendors. A page stay in Notion is not the same risk class as export-for-classification.

What Notion changed in the product

Per the quoted email:

Builders comparing hosted AI inside productivity suites should read this alongside output token inflation across labs: when vendors bundle analytics and inference through the same GPU host, breach blast radius spans usage metadata and prompt content.

What developers and admins should do

If Notion emailed your workspace

1. Open the in-workspace retrieval flow Notion provides in the notice (paths are workspace-specific; the HN paste redacts URLs).
2. Search exported chats for secrets, customer PII, unreleased product names, and internal URLs.
3. Rotate anything sensitive that appears — keys, OAuth refresh tokens, staging passwords, private repo URLs with tokens.
4. Notify your security lead and procurement — this is a subprocessor incident for many SOC2 programs.

If you did not receive email

The quoted notice implies most workspaces are outside the affected set. That is not a guarantee Fireworks held zero Notion-related bytes; it means Notion has not matched your tenant to the dataset yet. Continue Fireworks key rotation if your company also uses Fireworks directly.

If you only use Notion pages without AI

The email's narrow scope suggests classic page content was not in the described Fireworks dump. Still review AI feature adoption — one teammate enabling Notion AI can create transcripts you did not plan for.

How to protect agent and API workflows going forward

When third-party inference hosts hold evaluation logs, classification corpora, or fine-tune checkpoints, assume prompts become persistent attack surface. For agent deployments, use read-only access patterns and monitor for anomalous inference spend after supplier incidents.

For controls aimed at coding and tool-using agents, see AgentBeam's write-up on Notion and Fireworks dataset exposure for detection patterns that complement vendor email guidance.

Comparison: Notion email vs Fireworks bulletin vs press

Until Notion posts on notion.so/trust or Fireworks adds data-category detail, the email on HN is the most specific public description — with the caveat that it is customer comms, not a filed 8-K.

What people are asking

Is Notion itself hacked?
The described path is supplier breach at Fireworks, with Notion as downstream customer. That is still a Notion incident for your users if their AI chats leaked.

Should we disable Notion AI company-wide?
Notion already disabled Insights and Fireworks open-weight routing. Your decision is whether other Notion AI backends meet your data residency rules — the email does not list them.

Does this affect Claude or ChatGPT connectors?
The quoted email does not mention Anthropic or OpenAI connectors. Scope is Fireworks-hosted paths only.

How does this compare to NEAR AI's November pause?
NEAR AI paused confidential inference after internal access — a control-plane story with TEE claims. Notion's email describes transcript artifacts on a vendor GPU host — closer to dataset custody risk in Wiz's October AI platform wave.

What developers are saying on Hacker News

The Tell HN thread carried only the original post when we filed; the sole reply was flagged dead. Poster RamblingCTO reports receiving Notion's email and states they downloaded the dataset and saw a full chat tied to their use, which challenges Notion's "unattributable" phrasing in the same post. Treat that as one customer's report, not verified forensic analysis.

Architecture lesson: dual-use inference vendors

Notion's email highlights two common patterns that expand breach impact:

1. Analytics classification — batch jobs that store prompts to label usage patterns (Insights).
2. Product inference — serving open-weight models through the same vendor.

Both create retained text outside your SaaS boundary. When evaluating vendors, ask:

• Are prompts logged for ML ops even under "zero retention" inference SKUs?
• Are evaluation and production tenants isolated?
• Can you delete classification corpora independently from API keys?

Our semantic caching cost guide discusses another retention pattern — cache hits — that also stores paraphrased queries.

Enterprise procurement checklist

Link this incident in your next vendor review for any tool that routes Notion exports into GPU hosts — including homegrown agent harnesses.

Related reading

• Fireworks October 2026 breach update
• Fireworks Ember-1 and inference economics
• LLMjacking and stolen API keys
• NEAR AI confidential inference pause
• American Express workforce cuts and MCP agents
• Agent harness evolution and supply-chain risk
• AI labs token inflation and pricing

Sources

• Fireworks AI October 2026 security incident update, November 9, 2026.
• Hacker News Tell HN thread, November 10, 2026 (Notion customer email quoted by poster).
• Bloomberg Law on Fireworks customer support, November 9, 2026.

Incident scope changes as vendors publish forensic reports. Re-check Notion trust communications and Fireworks bulletins before closing your ticket.