Notion updated its security bulletin on the Fireworks AI breach yesterday, and the addition is the most uncomfortable part of the whole story: the leaked user messages contained API keys. On November 11, Notion revoked its own. On November 12 it reported the third-party keys it found to the vendors that issued them.
By Notion’s count, under one percent of all workspaces are affected. Those customers have been contacted; if you have heard nothing, your workspace is not on the list.
The timeline explains why it took six days
Fireworks AI is an inference platform for open models, used by tens of thousands of customers and hundreds of thousands of developers by its own numbers. Notion used it for classification jobs behind the “Insights” feature, and as a general provider for open-weight models inside its product.
On the evening of November 2, Fireworks reported that attackers had reached a small dataset. The investigation found Notion AI synthetic testing data and no customer data. By the morning of November 3, Notion disconnected all its systems from Fireworks and stopped communication between them. On November 4 it deleted all of its data in the Fireworks system. On November 6, Fireworks reported that attackers may have reached customer data after all. On November 8 the final dataset was confirmed, and on November 9 the notifications went out to affected customers.
That dataset held Notion AI chat transcripts from the Insights feature. For the vast majority of affected workspaces they are unattributable, Notion says: they carry no label for who wrote them or which workspace they came from, and they contain no tool call results. Whatever sits in the transcript itself, though, sits in there.
What Notion tells affected customers to do
Affected customers can review the impacted data securely inside their own workspace; instructions went out by email. Notion’s advice is blunt: treat this data as if it were exposed. Anyone who pasted passwords, API keys, or other credentials into Notion AI during the incident window should rotate them. The Insights feature is disabled while the investigation runs, and Notion no longer serves open-weight models through Fireworks.
The attackers were after tokens
According to Fireworks, an attacker compromised the company’s cloud provider and reached a Fireworks development system from there, which gave access to some customer data. Billing information and individual datasets were taken. Customers include the legal AI company Harvey and Cursor. Fireworks believes the attackers are financially motivated: their goal is reselling tokens from hijacked model access, so third parties burn through quota they never paid for. For Fireworks it is the second breach in two months.
Credentials in an AI chat reach every subcontractor behind it
Nobody broke into Notion’s systems here. What got broken into was the cloud provider of an inference vendor Notion used for a single feature, and at the end of that chain sit sentences people typed into a chat window. That those sentences held other vendors’ keys, in enough quantity to warrant a notification round of its own, is the part worth raising with your own team today. Every line in an AI chat sits with as many companies as the provider has subcontractors, and almost nobody knows that list.