Insights Security & Privacy
Notion AI chats exposed in a supplier breach: check for a notice
The short version
Notion says a breach at its AI supplier, Fireworks AI, exposed chat transcripts from a small share of workspaces. Anyone who typed passwords or keys into Notion AI chats should change them if they received a notice.
What happened
Notion uses Fireworks AI to run some of its AI models and to study chats for Insights, a feature that shows administrators how their teams use AI. An attacker got into Fireworks systems through another cloud provider, and Fireworks confirmed on 8 November that customer data had been reached.
The exposed data included Notion AI chat transcripts from the Insights dataset, which has now been disabled. In nearly all affected workspaces, the chats were not labelled with who wrote them or which workspace they came from. Notion says fewer than 1% of users are affected, and it has revoked exposed Notion API keys (access codes that let software connect to an account) found in the messages.
Why it matters to you
People may paste client details, meeting notes or login details into AI chats. If that happened in an affected workspace, Notion says to treat the data as if it were exposed.
The weak point was a supplier, not Notion itself. Your own security can be sound and your data can still be reached through the companies your software relies on.
What to do
Potentially affected workspace owners should open Security incident review in Notion's desktop web version, check the data, and share the link so members can download their own transcripts. Change any passwords, API keys or other credentials typed into affected chats.
If neither you nor your workspace owner received a notice, Notion says no action is needed for now.
Sources
- Fireworks AI incident Notion (security advisory) (opens in a new tab)
- Notion says Fireworks breach exposed customer AI chat transcripts BleepingComputer (opens in a new tab)
- Attackers breached the Fireworks AI storage where Notion AI chats sat outside zero data retention VentureBeat (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.