Fireworks AI disclosed in a November 9, 2026, security update that a breach at a third-party cloud provider allowed an attacker to reach its development machines and access customer data. The affected information included billing records, resource metadata and, for a limited set of accounts, secrets, datasets and incomplete model weights. Fireworks’ bulletin expanded the known impact of its October security incidents.
Notion subsequently confirmed that exposed data included Notion AI chat transcripts used for its Insights feature. It disabled Insights, stopped serving open-weight models through Fireworks and advised affected users to rotate credentials they had entered into impacted conversations. Notion said fewer than 1% of workspaces were affected. Its security advisory also records that it revoked exposed Notion API keys on November 11.
The consequential detail is where those transcripts lived. Fireworks said it had found no impact to several services that use zero data retention by default, yet a separate dataset containing customer conversations was exposed. For teams outsourcing AI inference, evaluation or analytics, that distinction makes a service-level retention promise an incomplete picture of their overall exposure.
How the Cloud-Provider Breach Reached Customer Data
Fireworks described a two-day sequence. A third-party cloud provider hosting its research and development machines experienced a security incident on October 23. On October 24, the attacker used that access to reach Fireworks development machines and run an unauthorized workload, leading to additional customer-data exposure.
Fireworks said it detected the activity that same day and took remediation measures. As of October 25, it had not detected further successful unauthorized access by the threat actor on the platform customers use. Those are detection statements from the company, not independent confirmation that every possible access path had been identified. Fireworks said its investigation remained ongoing; its update did not disclose the total number of affected customers or the volume of exposed files. Source: Fireworks
The company identified these affected categories:
- Resource metadata: identifiers, display names, descriptions, creation times and similar information.
- Billing information: billing and shipping addresses, invoices, payment history, account balances and credit usage.
- Secrets: credentials stored with Fireworks, including secrets used in evaluation jobs.
- Datasets and model weights: datasets and a subset of incomplete model weights belonging to certain customers.
Fireworks said it does not store payment card numbers, so those were not affected. The model-weight disclosure is also narrower than a claim that complete customer models were stolen: the bulletin specifically describes incomplete weights. Source: Fireworks
The published account identifies the route through the cloud provider and development machines, but it does not explain the exact vulnerability or permission chain that enabled access to customer information.
My view is that the development-system boundary deserves as much attention as the initial intrusion. Whatever the intended separation between research infrastructure and customer-facing services, the reported sequence shows that access through the development environment had customer-data consequences.
Why Notion’s Insights Dataset Matters
Notion used Fireworks to serve some open-weight models and to analyze stored conversations for Insights, a feature that gave workspace administrators visibility into their teams’ AI usage. The exposed transcripts came from the Insights dataset, according to BleepingComputer’s November 11 report, which detailed Notion’s disclosures.
The notification sequence shows why incident assessments can change materially:
| Date | What Notion reported or did |
|---|---|
| November 2 | Received an alert from Fireworks about an exposed dataset initially described as containing only synthetic test data. |
| November 3 | Cut off traffic to Fireworks, deleted data stored with the vendor and halted training runs. |
| November 8 | Received confirmation that customer data had been accessed and analyzed the supplied dataset, identifying Insights chat transcripts. |
| November 11 | Revoked exposed Notion API keys found in affected user messages. |
The November 2–8 sequence is documented in BleepingComputer’s reporting. TechCrunch also reported the November 3 disconnection and deletion, while the November 11 key revocation appears in Notion’s advisory.
Notion said the transcripts were unattributable for the vast majority of affected workspaces. In this context, that meant the chats were not labeled with their author or originating workspace. It also said the transcripts did not contain tool-call results, according to BleepingComputer.
Those limits matter, but they do not make conversation text harmless. A user can put a customer name, an internal URL, a password or an API token directly into a message. Removing an author field does not remove identifying details or credentials embedded in the text itself.
That is why I would treat unattributable transcripts as reduced attribution risk, not as anonymous data by default. Notion’s subsequent revocation of exposed API keys provides a concrete example of sensitive content surviving inside user messages.
What Zero Data Retention Actually Tells You Here
Fireworks said it had detected no impact to Inference, Training SDK and Nexus, which it described as zero-data-retention services by default. For Training SDK, the bulletin explains the condition as “no training data stored at rest.” Source: Fireworks
That statement concerns specified services and their handling of data. It cannot, on its own, describe every dataset, stored credential or analytics workflow associated with a customer account.
The published disclosures support a useful separation:
| Service or data path | Published position | Practical implication |
|---|---|---|
| Inference, Training SDK and Nexus | Fireworks reported no detected impact and described these services as ZDR by default. | Keep the claim tied to the named services and the investigation’s findings. |
| Notion Insights dataset | Notion confirmed exposed AI chat transcripts used for Insights. | Check separately whether analytics creates or receives a stored copy of conversations. |
| Batch Inference and dataset-based training | Fireworks disabled self-service dataset uploads and downloads during its response. | Uploaded datasets need their own inventory, access controls and retention rules. |
| Stored evaluation secrets | Fireworks said stored secrets were among the affected information. | Credential storage remains a separate security concern from prompt retention. |
BleepingComputer also reported that Notion said Fireworks had contractually committed to zero data retention for Notion data. The available disclosures do not resolve the contractual scope or explain why the Insights dataset remained stored. It would be premature to describe that dataset as an agreed exception to the commitment.
The narrower operational conclusion is well supported: a ZDR claim for a model-serving path is not a complete inventory of everything held elsewhere in the relationship.
A request might be processed through a service without being retained by that service, while another workflow stores a copy for analytics, evaluation or training. That is a general architecture risk, not a reconstruction of Notion’s undocumented implementation. The confirmed Insights exposure shows why customers need to ask about each copy and purpose separately.
Frequently Asked Questions
3 questions
1Were All Notion Workspaces Affected?
No. Notion said fewer than 1% of workspaces were affected. Exposed transcripts came from the dataset used for its Insights feature.
