🔍 Read the full analysis: Notion Says Fireworks Breach Exposed AI Chat Transcripts, Despite A Zero-Retention Promise on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says data accessed in the Fireworks AI breach included stored Notion AI chat transcripts used for its Insights feature, affecting fewer than 1% of workspaces. Notion says Fireworks had contractually committed to zero data retention, but its investigation found data from the endpoints Notion used had been retained. The companies have not said how long it was kept or which system stored it.
Notion says chat transcripts from its AI service were included in data accessed by attackers in the Fireworks AI breach, and that the data had been retained despite Fireworks’ contractual zero-retention commitment. The company says fewer than 1% of Notion workspaces are affected and that it revoked exposed Notion API keys found in affected user messages on November 11.
In its updated security notice, Notion said the dataset it received from Fireworks on November 8 included Notion AI chat transcripts used for the Insights feature. Insights provides workspace administrators with information about how teams use AI. Notion says that for most affected workspaces, the transcripts were not attributable to a particular person or workspace: they lacked labels identifying the author or workspace and did not include tool-call results.
That does not mean the transcripts were free of sensitive information. Notion defines a transcript as any input or output written to the AI chat. It says users should review affected data carefully because messages may contain sensitive material, including information people entered into the service. Notion says AI Meeting Notes were not affected unless audio, a transcript or a summary was used as input in a Notion AI chat. It said no other Notion features were affected.
Notion said it used Fireworks both for Insights classification jobs and to provide inference for open-weight models in its product. It identifies the exposed material as coming from the Insights-related data. On November 11, it also revoked exposed Notion API keys found in affected user messages. The company advises affected users to treat the data as exposed, review it under its Security incident review guidance and rotate passwords, API keys or other credentials they may have pasted into Notion AI.
Notion AI Chats ExposedFireworks breach tests zero-retention promise
Notion says attackers accessed stored AI chat transcripts sent to Fireworks for its Insights feature. The breach shows that data used for a separate product feature may be retained even when a vendor promises zero retention.
What was exposed
The accessed dataset included stored Notion AI chats used for Insights classification.
Chat text
Transcripts can include anything users wrote to or received from the AI, including sensitive details.
Identity labels
Most affected transcripts lacked author and workspace labels and did not include tool-call results.
Other features
Notion says no other features were affected. AI Meeting Notes were excluded unless their content was used in an AI chat.
How the vendor relationship worked
Notion describes two uses of Fireworks and says the exposed dataset came from Insights.
| Fireworks use | Role | Exposure |
|---|---|---|
| Insights | Classified stored AI requests and responses | Included in accessed dataset |
| Open-weight models | Provided product inference | Not identified as the source |
What remains unclear
The published notices leave key retention and scope questions unanswered.
- Fireworks had contractually committed to zero data retention.
- Data from the endpoints Notion used had nevertheless been retained.
- Notion disconnected its systems and deleted data in the Fireworks system.
- Which Fireworks system stored the data, and for how long.
- Why retention occurred despite the commitment.
- Whether other Fireworks customers were affected.
Why Stored AI Chats Raise Risks
The disclosure highlights a distinction between a model provider’s handling of a live prompt and the storage needed for a product feature. Notion says its zero-data-retention commitments for model requests apply to requests sent to third-party vendors to generate responses. But it says those commitments were not designed to cover data stored for features such as chat history and Insights.
For customers, the issue is not only whether a provider retains prompts during ordinary inference. Data may also be stored or sent to a vendor for a separate service, such as analysis. Notion says it sent stored requests and responses to Fireworks for Insights, and that Fireworks had made a contractual commitment to retain no data. The finding that data nevertheless was retained raises questions about how customers can verify vendor controls and how contracts are enforced after a breach.
The potential exposure matters because people may use workplace AI chats to discuss customer details, internal plans or credentials. Notion has not said that every affected transcript contained sensitive material, nor has it reported that all such information was misused. Its recommendation is to inspect the relevant content and rotate credentials that may have appeared in it.
Products Worth Considering
Bose Lifestyle Ultra Soundbar and Ultra Subwoofer Bundle
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion’s notice describes two Fireworks uses: classification for Insights and inference for open-weight models in Notion’s product. The company says the exposed dataset involved the former. It also says it disconnected its systems from Fireworks, deleted data in the Fireworks system and stopped communications with the provider on November 3, after Fireworks first notified it on November 2 that a small set of data had been accessed. Notion says that initial material was synthetic testing data.
Notion later received further information from Fireworks about possible customer data access. The company’s updated notice identifies the November 8 dataset as including the chat transcripts. Fireworks’ own update, dated November 9, said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-retention by default; it also listed datasets among data accessed for certain customers. The published statements do not identify which system retained Notion’s data, so the relationship between the two descriptions remains unresolved.
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. Its notice says affected workspaces are fewer than 1% of all Notion workspaces. Notion says that if neither a user nor the workspace owner has received notice, it has not identified that workspace as affected.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its updated security notice
Questions About Retention and Scope
The notices do not say which Fireworks system retained Notion’s data, how long it was stored, or why the retention occurred despite the contractual commitment. They also do not give a count of affected people or workspaces beyond Notion’s estimate that fewer than 1% of workspaces are affected.
It remains unclear whether the same retention issue affected other Fireworks customers. Fireworks’ public update and Notion’s explanation describe different parts of the incident, but neither provides enough detail to reconcile them. Notion has not reported that exposed chat content was used by attackers beyond being accessed as part of the breach, and the published information does not establish whether any credentials or other sensitive details were extracted or exploited.
Vendor Audit and User Reviews
Notion says it is auditing critical vendors and checking whether they follow data-minimization practices, including zero-retention policies. The company has not announced a completion date for that audit or provided a further timetable for its investigation. It may publish additional details as it learns more about how the data was retained and accessed.
Users who have been contacted should follow Notion’s incident-review guidance and examine the affected data, paying particular attention to information they entered in AI chats. They should rotate any passwords, API keys or other credentials included in those conversations. Workspace owners who have not received a notice can check with Notion if they need confirmation about their organization’s status. The scope of any wider impact will depend on further information from Notion and Fireworks.
Key Questions
What Notion data did the Fireworks breach expose?
Notion says a dataset accessed by attackers included Notion AI chat transcripts used for its Insights feature. It says most affected transcripts were not labeled with an author or workspace and did not include tool-call results, but they could still contain the text users entered or received in chats.
How many Notion workspaces are affected?
Notion says fewer than 1% of workspaces are affected. It has not published a specific number of workspaces or people.
Does the zero-retention commitment mean no data was stored?
Not in this case, according to Notion. It says Fireworks had made a contractual zero-retention commitment, but its investigation found that data from the endpoints Notion used had been retained. Notion also says its own zero-retention commitments for live model requests do not cover stored data used for features such as chat history and Insights.
What should affected users do?
Notion advises affected users to treat the data as exposed, review it under its Security incident review guidance, and rotate any passwords, API keys or other credentials they pasted into Notion AI.
Were Notion AI Meeting Notes affected?
Notion says Meeting Notes were not affected unless their audio, transcript or summary was used as input in a Notion AI chat. It said no other Notion features were affected.
Source: ThorstenMeyerAI.com
