AI and security briefsSecurity

Were my Notion AI chats exposed in the Fireworks AI breach, and what should I rotate?

By Brandon Da Costa, founder of Digiton Dynamics

Published 12 November 2026Updated 12 November 2026Editorial policy

Fireworks AI says an intruder reached account, billing and some customer data in two steps, in October. Notion says AI chat transcripts from fewer than 1% of its workspaces were exposed through Fireworks. If anyone pasted a key or password into Notion AI, rotate it now.

Who should act: Notion workspace owners, anyone who pasted credentials into Notion AI, and teams that keep environment variables or datasets with Fireworks AI or another inference provider.

What happened

Fireworks AI says it found unauthorized use of internal credentials on 6 October 2026. An outsider captured environment variables and secrets used in evaluation jobs in a limited number of customer accounts (Fireworks bulletin, 9 October).

On 9 November Fireworks updated that bulletin. It now reports impact to account and billing information, and for a limited set of accounts to secrets, datasets and incomplete models. It says a third-party cloud provider that hosted its R&D machines had an incident on 23 October, and that on 24 October the intruder used it to reach development machines and run an unauthorized workload. Fireworks says it detected this the same day and links the evidence to a financially motivated group that sells model access, known as LLMjacking (Fireworks update, 9 November). It says card numbers are not stored and that Inference, Training SDK and Nexus, which are zero data retention by default, showed no impact so far.

Notion, a Fireworks customer, says Fireworks notified it of an incident that exposed AI chat transcripts from fewer than 1% of Notion workspaces (Notion Help Center, 12 November). It says it used Fireworks for classification jobs behind its Insights feature and to serve open-weight models, and that Fireworks had committed to zero data retention by contract. Notion says it learned data was retained on those endpoints. It disconnected from Fireworks on 3 November and deleted its data there.

Who is affected

• Notion workspaces that Notion has contacted. If neither you nor your workspace owner heard from Notion, it has not identified your workspace, though its investigation continues.
• Anyone who typed or pasted a password or API key into Notion AI. A transcript holds any input to or output from the model that was written to the chat.
• Fireworks customers with a notice. Fireworks revoked keys and tells you to rotate third-party credentials it lists.
• Enterprise customers counting on zero data retention. Notion says its commitment covers API requests to vendors, not features that store data such as chat history and Insights.

What we checked

Run on 12 November 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ curl -s https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor | grep -o -E 'fewer than 1% of Notion workspaces|As of November 3rd, we have disconnected our systems from Fireworks' | sort -u
As of November 3rd, we have disconnected our systems from Fireworks
fewer than 1% of Notion workspaces

$ curl -s https://fireworks.ai/security/bulletins/october-2026-security-incident-update | grep -o -E 'security incident on October 23|Payment card numbers are not stored by Fireworks' | sort -u
Payment card numbers are not stored by Fireworks
security incident on October 23

Both pages carry these statements as of today. Neither gives the dates the Notion transcripts were taken.

What to do now

1. Workspace owners: open the sidebar, then ? , then Security incident review, in a desktop browser on the latest Notion. Download the affected members list and share the link with each member.
2. With a verified domain you also get content files. Read the annotated one, whose analysis column flags chats that hold likely secrets, and rotate those at the provider that issued them before you update the apps.
3. Fireworks customers: replace revoked keys, since those apps fail until updated, and rotate every third-party credential in your notice.

   git grep -n -i fireworks -- '*.env*' '*.yml' '*.yaml'

4. Read usage and billing on exposed keys from 6 October on. Fireworks says the group resells model access, so look for spend you did not make.
5. Ask each AI vendor in writing where prompts are stored and which features sit outside zero data retention.

What should have been in place

• No secrets in chat prompts. Keep keys in a secrets manager and use short-lived tokens.
• Zero data retention checked, not assumed. Notion is auditing its critical vendors for exactly this.
• Secrets kept out of evaluation job variables. Fireworks says it is reviewing how jobs receive secrets.
• A key per vendor with spend alerts, so resold access shows up as a spike.
• A list of every vendor that sees your prompts.

Questions people ask

Digiton's production review maps which vendor sees each prompt, key and dataset and how fast you could rotate every one, and the checks are on the vibe coded app audit page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. Fireworks AI, October 2026 security incident bulletin, 9 October 2026, read 12 November 2026. https://fireworks.ai/security/bulletins/october-2026-security-incident
2. Fireworks AI, update on the October 2026 security incident, 9 November 2026, read 12 November 2026. https://fireworks.ai/security/bulletins/october-2026-security-incident-update
3. Notion Help Center, security incident involving a third-party AI vendor, read 12 November 2026. https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor

More briefs

How these briefs are sourced and corrected. All AI and security briefs