Notion says some unattributable chat sessions with its AI assistant (not labelled with who wrote them or which workspace they came from) may have been exposed in a security incident at Fireworks AI, which ran AI models for it. Fewer than 1 percent of Notion workspaces may be affected. Notion advises rotating any password or key pasted into Notion AI during "this timeframe", which it does not define.
When you type a question into the AI assistant of a work app, your words may pass through another company you never chose. Think of a restaurant that buys its sauces from a supplier: you eat at the restaurant, but part of the meal is made elsewhere.
Notion, a workspace app, used an AI infrastructure company called Fireworks AI for some of its AI features. Notion says some chat sessions with its AI assistant may have been exposed in a security incident at Fireworks. It calls them unattributable: not labelled with who wrote them or which workspace they came from. It says fewer than 1 percent of its workspaces may be affected. Below: what each notice says, what neither says, and what to do this week.
Status as of November 10, 2026. Fireworks marks its notice "Active monitoring" (its status label), so the page can change. Notion has two pages on this: a Help Center notice, which prints no date (we saw it on November 10), and a security advisory marked "Updated November 9, 2026". Each page is its own account.
Who is Fireworks, and why does a Notion notice mention it?
Fireworks AI runs AI models for other companies. Running a finished model to answer a question is called inference, and Notion says it used Fireworks "as a general inference provider to serve open-weight models inside our product". Open-weight means the model's trained settings are published so others can run it.
Notion also says it used Fireworks "for classification jobs to help customers understand their own AI usage through a feature in Notion called Insights". A classification job sorts items into categories. In short, for the two uses Notion names, the chain was you, then Notion, then Fireworks.
What does Notion say?
In its Help Center notice, Notion says its security team "determined that <1% of Notion workspaces may have been affected by the Fireworks security incident". It adds: "Some unattributable chat sessions with Notion AI may have been exposed in this incident." Notion's wording is "may have been", so it does not say they were.
"Unattributable" is Notion's word, and it defines it. The chats "weren't labeled with who wrote them or which workspace they came from", and the transcripts "did not contain tool call results". A tool call result is content the AI pulled in from elsewhere, such as a page of yours. Notion also says: "Beyond what's in the chat transcript itself, there's no information tying the chat back to a workspace, user, or company." And: "No other data from within the workspace is affected."
Notion's separate security advisory says Fireworks notified Notion on "the evening of November 2" that "a small set of data had been accessed", and that on investigation "the dataset included Notion AI synthetic testing data, and no Notion AI customer data was involved". It says the chat transcripts, "for the vast majority of impacted workspaces", were unattributable. The Help Center notice does not use the words "vast majority", and the pages do not say whether the two wordings mean the same.
Notion's two pages give four dates. The Help Center notice prints November 6 and 8 in the main text and November 3 in its FAQ; the advisory adds November 2 and lists them in calendar order. We follow that order, which is Notion's own, and draw no conclusion from it.
| Date as Notion prints it | What the notice says |
|---|---|
| "On the evening of November 2" (advisory) | Fireworks notified Notion that "a small set of data had been accessed". Notion says the dataset "included Notion AI synthetic testing data, and no Notion AI customer data was involved" |
| "by the morning of November 3" (advisory); "As of November 3rd" (Help Center) | Notion has "disconnected our systems from Fireworks, deleted all data in the Fireworks system", and stopped sending data to it |
| "On November 6" | Fireworks notified Notion that potential customer data may have been accessed. Notion began another internal investigation |
| "On November 8" | Fireworks "confirmed this new dataset" for Notion. Notion says the data "included unattributable Notion AI chat transcripts used for the Insights feature" |
For affected workspaces, Notion says Enterprise owners with managed members can access a CSV (a plain data file) of the affected data and an annotated CSV with metadata "such as the user associated with each chat transcript", which Notion says was "not exposed as part of the incident". Owners on other plans get a page with a link to share with affected members, who then see only their own data.
What does Fireworks say?
Fireworks published its first notice on October 9, 2026; the page says it was last updated October 10. The update, last updated November 9, describes two items under separate headings, "The update" and "Further activity", and we keep them apart.
One item: "The update". The update says that when the first notice came out, "only Fireworks stored secrets" were known to have been accessed. A secret is a password or key that proves to a service who is calling. Then it says: "Since then, we discovered impacts to account and billing information. For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models." In that same opening section it adds: "The evidence indicates links to a cybercriminal threat actor group". Fireworks goes on to describe the group as financially motivated and aimed at selling tokens from unauthorized access to AI models. It does not say which impact or event this refers to. That is Fireworks's own assessment; the post it links from Google and Mandiant is one we did not read. Wider context: our earlier piece on AI developer platforms and key incidents.
A list headed "Data involved" opens: "The affected internal application provided access to the following categories of information". It names resource metadata, "Billing information" such as "invoice and payment history", and "for certain customers, a subset of incomplete model weights and datasets were accessed". It says "Payment card numbers are not stored by Fireworks and were not impacted." The page uses both "incomplete models" and "incomplete model weights" and does not define "incomplete". Weights are the learned numbers inside a model.
The other item: "Further activity". Fireworks says: "A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23. On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact." A workload here means a program run on a computer. Fireworks adds that it "detected this activity on the same day". The update does not name the provider.
The update says the October 24 activity "led to additional customer data impact" but does not say which of the impacts it lists (account and billing information; secrets, datasets, and incomplete models) belong to it, and we do not link them. Notion's notice, for its part, does not say which Fireworks event its dataset came from, so we do not link the two.
Fireworks also says: "We have not detected any impact to Inference, Training SDK and Nexus", its names for three services. It says this is "based on our investigation to date" and that the investigation "is ongoing".
Do the two notices describe the same thing?
The pages we read do not answer that. Notion's Help Center notice calls it "the Fireworks security incident"; the two Fireworks pages we read never mention Notion, so we do not join them. Side by side:
| Notion's pages | Fireworks's update | |
|---|---|---|
| Date printed | Help Center notice: none (seen November 10, 2026). Security advisory: "Updated November 9, 2026" | "Last updated November 9, 2026", status "Active monitoring" |
| What it names | "Some unattributable chat sessions with Notion AI" | "account and billing information"; for "a limited set of accounts", "secrets, datasets, and incomplete models" |
What can you do this week?
Anything marked "in our reading" is ours.
Do this week
Five steps for an owner or an IT lead; no new software needed.
- Check whether Notion has contacted you or your workspace owner. The Help Center notice says that if neither has heard from Notion, "your workspace is not affected, and no action is needed right now"; the security advisory says "we haven't identified your workspace as affected". Contacted owners can view the affected data under the sidebar, then "?", then "Security incident review", in a desktop browser. The notice does not say whether that item shows for other workspaces.
- In our reading, ask your team whether anyone pasted a password, key or other credential into Notion AI. Notion says: "If you or anyone on your team pasted sensitive information like passwords, API keys, or other credentials into Notion AI during this timeframe, we recommend rotating them right away." The security advisory words it for "those with affected workspaces" and "during the timeframe of the incident", and does not define that period either. Rotating means making the old one stop working and issuing a new one. Neither page defines the period, so we would ask Notion which one applies.
- In our reading, change a key where it was issued. Separately, Fireworks's first notice, written for its own notified customers, says: "Removing a stored secret alone does not invalidate the underlying credential." That notice does not mention Notion. In plain terms: deleting your copy does not switch a key off; the company that issued it must.
- If you are a Fireworks customer, look for its notification email. Fireworks says it is "notifying customers whose data was impacted, and providing details about the impact and recommended response actions".
- In our reading, ask each AI tool vendor in writing which other companies handle your prompts and chats. We are not lawyers: ask your counsel whether any contract or law requires you to tell anyone.
What we checked and what we could not
We read four public pages on November 10, 2026: Fireworks's update ("Last updated November 9, 2026"), Fireworks's first notice (published October 9, last updated October 10), Notion's Help Center notice (no date printed) and Notion's security advisory ("Updated November 9, 2026"). We tested nothing. The pages we read do not publish an independent review of what happened. We did not read the emails sent to customers or workspace owners, or the Google and Mandiant post that Fireworks links.
Notion's two pages and Fireworks's two bulletins do not state:
- how many chats, Notion workspaces beyond "<1%", or Fireworks customers are involved;
- what period "this timeframe" (Help Center) or "the timeframe of the incident" (advisory) means;
- whether the words in a chat could identify a person or company (Notion's FAQ asks "Could the conversations still contain sensitive information?" and answers by advising you to treat the data as if it were exposed);
- which Fireworks event or discovery produced the dataset Notion describes;
- the cloud provider's name, or how it was affected;
- what "incomplete models" means.
Read next: a command with a secret in it saved to a settings file and our guide to evals, guardrails and human review for AI agents in production.
Sources
- Fireworks AI: Update on October 2026 security incident, last updated November 9, 2026, read November 10, 2026 (the company's own account)
- Fireworks AI: Fireworks October 2026 security incident, published October 9, last updated October 10, 2026, read November 10, 2026
- Notion security advisories: Fireworks AI incident, updated November 9, 2026, read November 10, 2026 (the company's own account)
- Notion Help Center: Notice about the Fireworks AI incident that may impact some Notion workspaces, no date printed, seen November 10, 2026 (the company's own account)