fireworks ai breach: Hackers Took Notion AI Chat Transcripts
The fireworks ai breach reached customer data through a cloud provider; Notion says Notion AI Insights chat transcripts were taken, affecting under 1% of workspaces, and it cut ties with Fireworks for that work.
- Fireworks says attackers breached a third-party cloud provider, reached a development system, and took billing information and some datasets.
- Notion says the stolen data included Notion AI chat transcripts used for Insights, which were mostly "unattributable" to a user or workspace.
- Notion disabled Insights, stopped serving open-weight models through Fireworks, and told affected customers to rotate any credentials they pasted into chats.
in this block
The fireworks ai breach is a reminder that your AI chats can leak through a company you never signed up with. Fireworks AI, an inference platform that serves open models to tens of thousands of customers, confirmed that attackers reached customer data through its cloud provider. Notion, one confirmed customer, says chat transcripts from its Notion AI "Insights" feature were taken, affecting fewer than 1% of its workspaces.
What actually happened
According to TechCrunch's report, Fireworks said in a security advisory that an attacker breached its cloud provider to access a Fireworks development system. From there, the attacker reached customer billing information and some datasets. Fireworks believes the hackers are financially motivated and focused on selling tokens from stolen access to large language models, a practice often called LLMjacking.
TechCrunch says this is the second incident affecting Fireworks in as many months. SecurityWeek reported that Fireworks was hit twice in October, once through compromised internal credentials and once through the third-party cloud provider, with the second intrusion on October 24.
Notion's timeline
Notion's own security advisory lays out the sequence:
- November 2: Fireworks told Notion a small dataset was accessed; Notion initially found only synthetic testing data.
- November 3: Notion disconnected from Fireworks, deleted its data there and cut communication.
- November 6: Fireworks said potential customer data may also have been accessed.
- November 8: Fireworks confirmed the final impacted dataset, which included Insights chat transcripts.
- November 9 onward: Notion contacted affected customers, revoked exposed Notion API keys on November 11, and on November 12 reported third-party API keys found in user messages to the vendors that issued them.
Notion used Fireworks for classification jobs behind Insights, which shows admins how their teams use AI, and as an inference provider for open-weight models.
Why the fireworks ai breach matters beyond Notion
This is a supply-chain problem. Most people using Notion AI never chose Fireworks. They chose Notion, which chose Fireworks, which used a cloud provider that got breached. Each layer adds risk that end users cannot see.
VentureBeat pointed out a second lesson. Fireworks advertises zero data retention by default for inference, but its own policy page says some features, like stored responses, batch jobs and training, do keep customer content. The breach reached the stored side. Even the wording shifted: Fireworks' November 9 update said it had not detected impact to Inference, Training SDK and Nexus, while CEO Lin Qiao's post on X said the same but added "excluding batch inference." "Zero retention" is often a default for one path, not a guarantee for every product.
If you pasted a password into an AI chat, assume it is stored somewhere, by someone, longer than you think.
Credentials in chats are the real damage
The most practical risk here is not embarrassing notes. It is API keys and passwords. Notion found exposed API keys in affected messages, which is why it revoked its own and flagged others to their issuers. People paste secrets into AI tools all the time to debug code or configure services. A transcript leak turns that habit into a live security incident.
We have covered similar AI-side leaks in near ai breach and claude code settings leak. The pattern is consistent: the weak point is often the plumbing around the model, not the model itself.
What to do as a reader
The fireworks ai breach is a good prompt to clean up your own habits:
- Check your email. Notion says it contacted affected customers directly; if you heard nothing, it has not identified your workspace.
- Rotate secrets. If you pasted keys or passwords into any AI chat, rotate them anyway.
- Ask about vendors. Teams on business plans should ask AI tools which inference providers they use and what is retained.
- Treat chats as documents. Do not put anything in an AI chat you would not put in a shared doc.
Not financial advice. DYOR, ser.
