Notion AI Chat Logs Leaked in a Fireworks AI Breach, Rotate Any Key You Pasted

Conversations people had with Notion AI ended up in an attacker's hands by way of a third-party AI vendor. Notion published a security incident notice on November 10 saying that Fireworks AI, the partner it had been sending those conversations to, was breached and that some Notion AI chat logs were exposed. Fewer than 1% of Notion workspaces are affected. Notion's instruction is direct: if you pasted a password or an API key into Notion AI during that window, change it now.

The notice also made public something Notion had not advertised. Notion AI conversations traveled past Notion and the model vendor to a third company.

What Leaked: Chat Logs With the Author Stripped Off

What leaked is the text of conversations with Notion AI. Notion sent those logs to Fireworks to power a feature called Insights, which shows a customer how their own organization is using AI. Sorting the conversations by topic was the job Fireworks did.

Here is the exposure scope Notion stated.

• Included: the questions users typed into Notion AI and the answers it returned.
• Excluded: any marker of who wrote them or which workspace they came from. Notion page content and external data that Notion AI pulled in mid-conversation are also absent.
• Other data: Notion says no workspace data beyond the chat logs was affected.

Fireworks did one more job for Notion: serving open-weight models (models whose weights are published, so anyone can download and run them) inside the product. In an early-access program called LEAP, where customers volunteer their own data, Notion also experimented with training task-specific models at Fireworks. The notice does not say whether the leaked conversations were LEAP data.

Notion has switched Insights off and stopped serving models through Fireworks. The notice never says which dates the leaked conversations cover. The advice only says to rotate keys pasted during that period, without saying when that period was.

The Fireworks Breach Started on October 6

Fireworks AI is a cloud vendor that runs open-weight models for other companies. Developers use it to call or fine-tune models such as Llama or DeepSeek through an API instead of buying GPUs themselves. The Fireworks breach began a month before Notion's notice.

The October bulletin and the November update do not say the same thing. The first bulletin said only environment variables such as keys and tokens had leaked. The November 9 update added resource information, billing addresses and payment history, and unfinished model weights and datasets belonging to some customers. Card numbers are not stored, so they are unaffected. Both bulletins describe the number of affected customers only as a limited number.

Fireworks tied the incident to a financially motivated group that resells stolen AI capacity. The method is to call models with someone else's API key, then sell that usage cheaply through an illicit relay service. The industry calls it LLMjacking. Fireworks was already on the list when we covered keys leaking from nine AI development platforms in October.

The chart above is not the Fireworks incident. It is a different victim, published in the LLMjacking report that Google Threat Intelligence Group released on November 3. One stolen key called models more than 500,000 times in under eight hours. GTIG put one victim organization's token bill at roughly $1 million. The report does not mention Fireworks.

Why "Unattributable" Is Not Reassurance

Notion itself wrote that users should treat the content as exposed. The claim that the conversations carry no name tag and the instruction to change passwords sit in the same notice. If the question text contains a company name, a customer email, a server address, or a key, the missing name tag does not keep it anonymous.

The Hacker News thread (155 points, 57 comments) landed on the same problem.

• The most common objection: conversation content is identity data, so calling it unattributable misleads.
• In a post that went up before Notion's notice, one user wrote that the dataset they received held their own conversations in full. The claim is unverified.
• Others asked why Notion data was sitting at Fireworks at all, given that Fireworks has said it does not retain inference requests by default. The Fireworks update shows the affected features were not ordinary inference but batch jobs and training that run on an uploaded dataset. Neither notice says which path Notion used.

Notion's AI security page states that customer data is not used for model training by default and that its contracts with AI providers prohibit training. Retention differs by plan. On Free, Plus, and Business, the AI provider deletes the data after up to 30 days. On Enterprise, most models do not store it at all. The notice does not say which of those rules covered the Insights classification data.

How to Check Whether Your Workspace Is Affected

Notion contacted affected workspace owners individually. If neither you nor your workspace owner heard from Notion, the notice says you are not affected and there is nothing to do right now. Notion's notice names no country or region, so the check is the same wherever the workspace sits.

If you build on Fireworks directly, work through the first Fireworks bulletin separately from the Notion notice. Third-party keys you stored at Fireworks (OpenAI, Anthropic, AWS and others) are not invalidated by deleting them from Fireworks and have to be rotated at the issuer, the bulletin stresses.

One duty the notice does not cover is your own. If your workspace is affected and those conversations carried your customers' personal data, the breach notification obligation falls on your organization, not on Notion. Singapore's PDPA requires notifying the PDPC no later than three calendar days after you determine a breach is notifiable, which it is when the breach is likely to cause significant harm or reaches significant scale, set in the regulations at 500 or more affected individuals. Under the GDPR the window is 72 hours. The missing date range makes that assessment harder, because you cannot scope which conversations to review.

If you got the email, start by searching the CSV for strings such as sk-, AKIA, and password to see whether a key you actually pasted is in there. If you got no email but remember typing a credential into Notion AI, rotating that one key this week costs less than the alternative. Notion never published the date range, so there is no basis for deciding you were fine back then.