What happened
Notion confirmed (advisory updated Nov 10, 2026) that a security incident at its AI infrastructure provider Fireworks AI exposed Notion AI chat transcripts generated for the Insights feature, affecting fewer than 1% of customer workspaces. Notion's own systems were not breached and no other features were affected; Insights has been paused and Fireworks-hosted models disconnected while the investigation continues. This is the customer-facing downstream disclosure of the Fireworks AI breach (the attacker accessed customer datasets and incomplete model weights at Fireworks).
Why it matters
This is a distinct victim-ecosystem disclosure from the Fireworks attribution story: it shows how a compromise at an AI infrastructure provider cascades into the AI data of that provider's customers and their end users. The exposed material is model-facing conversation content — which can hold secrets, credentials, and internal business data that an LLM was given — making AI chat logs a new class of breach data, separate from the 'attacker stole weights/datasets' story at Fireworks itself.
Attack vector
An attacker compromised a third-party cloud provider hosting Fireworks AI's R&D machines (Oct 23), used it to access Fireworks (Oct 24), and reached resources including customer datasets and billing data. Notion AI chat transcripts processed for the Insights feature were caught in the exposed dataset. Fireworks first alerted Notion Nov 2; Notion disconnected and deleted data Nov 3; Fireworks revised the affected dataset on Nov 8; Notion notified impacted customers Nov 9 and revised its advisory Nov 10.
Affected systems
Notion AI (Insights feature) processed via Fireworks AI infrastructure; affected workspace transcripts. Notion's own systems were not breached.
Mitigation
No patch — incident response. Affected customers should treat the exposed transcripts as disclosed, rotate any passwords/API keys/secrets pasted into Notion AI during the incident window, and review Notion's in-workspace data-review instructions. Organizations should apply vendor least-privilege, know what data third-party AI providers hold, and pre-plan credential revocation.