Notion disclosed on November 11 that the Fireworks AI breach exposed customer chat transcripts across a small fraction of workspaces. The team cut ties with Fireworks AI after rogue workloads on dev servers accessed customer records. Bill Toulas reported for BleepingComputer that Notion confirmed fewer than 1% of customer workspaces were impacted by the incident [1].
Fireworks AI Breach Timeline
Fireworks AI first detected illicit activity on October 6, 2026, at 9 a.m. PDT, when an intruder used internal logins to view environment variables in evaluation jobs. The AI provider disclosed that first incident on October 10. Secrets, including API keys and service tokens, had been captured across customer accounts. Fireworks AI revoked internal logins and rotated service tokens to protect customer models. But Fireworks AI later discovered that the intruder had created rogue Fireworks API keys during that early October window, forcing more token resets [2].
Attackers reached dev machines on October 23, 2026, through an unnamed third-party cloud provider hosting research and development (R&D) hardware for Fireworks AI. On October 24, intruders used that opening to run an illicit workload on Fireworks AI dev machines. Fireworks AI said it saw no signs of rogue access on the customer platform after October 25 [2].
Fireworks AI said the threat actor accessed resource metadata, billing files, and incomplete model weights. Stolen metadata held resource identifiers, display names, descriptions, and creation times, while billing records exposed shipping addresses, invoice history, account balances, and credit usage. Fireworks AI does not store payment cards, so card numbers stayed safe. Fireworks AI alerted all customers whose datasets were touched during the hack [2].
Exposed Notion AI Transcripts
Notion builds software where teams draft documents, maintain project wikis, and organize daily tasks. Notion AI helps users write text, summarize pages, and answer questions. Notion partnered with Fireworks AI to run open-weight models and power Insights, a tool that lets workspace managers view how teams use AI. That setup meant Fireworks AI processed customer prompts and responses for Notion [1].
Notion received an alert on November 2. Fireworks AI said an exposed file held only synthetic test data, leading Notion to cut off traffic, delete all vendor data, and halt training runs by November 3. That initial assessment fell apart on November 8. Fireworks AI sent an updated dataset proving real customer chats had been leaked, prompting Notion to state: “Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable”. Bill Toulas reported for BleepingComputer that Notion had relied on Fireworks AI to run open-weight models and evaluate chat queries [1].
Notion clarified what unattributable meant for user privacy. “Unattributable means the chats weren’t labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results,” Notion said. Fireworks AI had contractually promised a zero data retention policy for Notion data. Storing transcripts in the Fireworks AI dataset breached that agreement [1].
Steps for Affected Workspaces
Notion disabled Insights right away. The team stopped serving open-weight models through Fireworks AI while making sure databases, wikis, and core documents remained safe on internal systems [1, 2]. Other workspace features were unaffected. Cutting links to Fireworks AI helped make sure active Notion AI chats could not send fresh text to the vendor [1].
Notion posted a FAQ page for concerned teams. Workspace admins can open the Security incident review tool in the desktop web interface to inspect leaked logs and share private download links with members. Most accounts need no changes. Notion said teams that did not receive a notice can continue normal work because less than 1% of users were affected by the incident [1].
Users who pasted secret credentials into Notion AI chats face clear recovery advice. Notion advises affected users to rotate passwords, API keys, or secret tokens entered during prompt sessions [1]. Fireworks AI also adopted new defenses, such as isolating affected systems, tightening access controls, and boosting audit logs to halt lateral movement across cloud hosts [2].
What the Fireworks AI Breach Stole
Fireworks AI linked the breach to a profit-driven cybercrime ring targeting cloud AI setups. The attackers sought API tokens to resell access to large language models through illicit routing gateways. Security researchers call this tactic LLMjacking, where hackers hijack corporate models using stolen keys to run an illicit business, leaving the account owner to pay the compute bills. The stolen keys allow outside buyers to query advanced models cheaply [2].
Cloud intrusions differ from common social engineering attacks. While credential schemes where hackers target corporate accounts with fake AI events rely on phishing lures to trick staff, the Fireworks AI breach involved direct entry into cloud dev hardware. The incident showed that hackers now target backend systems where datasets and model weights reside. Accessing dev clusters gives intruders raw compute power and training assets that sell fast on dark markets.
Fireworks AI revoked internal keys quickly. In a report by The Hacker News, Fireworks AI stated that attackers took incomplete model weights and customer datasets before locks engaged across dev clusters. Building model weights takes months of heavy training costs, and losing them lets rivals copy proprietary designs without spending money on GPUs [2].
Google Warns About LLMjacking
The Fireworks AI breach matches a growing wave of attacks hitting AI platforms. Google issued a warning last week that threat groups are targeting AI clouds for LLMjacking in North America, South America, and Asia Pacific. Google said hackers focus on financial firms, retail, technology, and transit providers to steal processing power [2].
Public reaction among software users showed doubt about vendor breach metrics. On Reddit, forum members talked about the Notion disclosure, with one poster writing: “looks like all of us are part of that <1%”. That online comment captured broad skepticism about cloud security notices that minimize leaks by citing tiny workspace percentages [2].
As teams connect Notion AI to company wikis and daily notes, third-party cloud providers pose real security questions. The Fireworks AI breach shows how a break-in at an AI host can expose chats from clients that relied on zero-retention promises. Bill Toulas reported for BleepingComputer that Fireworks AI had contractually promised zero data retention for Notion data [1]. Organizations using open-weight models must audit third-party pipelines, check vendor logs, and verify how tools handle prompt text. Without independent checks on retention terms, teams risk exposing private talks whenever a cloud dev host is breached [1, 2].
- ONLINE NEWS Toulas, B. (2026, November 11). Notion Says Fireworks Breach Exposed Customer AI Chat Transcripts. BleepingComputer. [Article Link]
- ONLINE NEWS The Hacker News. (2026, November 10). Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats. The Hacker News. [Article Link]
