Fireworks AI breach exposes Notion chat transcripts for fewer than 1% of workspaces

Notion is notifying a small number of customers that their Notion AI chat transcripts were accessed after Fireworks AI, an inference provider used to run open-weight models, was compromised in October. Fireworks disclosed two intrusions: one through stolen internal credentials and another through a third-party cloud environment hosting research and development machines. The second incident, on Oct. 24, involved an unauthorized workload that reached customer data, and Notion said Fireworks contained it the same day and notified Notion on Nov. 2.

The exposed data was narrower than a full workspace dump. Notion’s investigation found attackers accessed Notion AI chat transcripts used for Insights, a feature that summarizes how customers use AI. Notion said fewer than 1% of workspaces were affected and most transcripts were unattributable to a customer or workspace. The company added that, beyond the transcript text, there is no information tying the chats back to workspaces, users or companies. Notion has contacted affected customers but did not disclose the number affected.

Fireworks’ description splits the technical trail from the threat label. The company links the Oct. 24 workload abuse to a rise in LLMJacking, a term for attackers using stolen or exposed model inference access to run unauthorized jobs. That framing fits the operational pattern: credentials and third-party hosting are entry points, while the payload is compute and data access rather than malware. Notion’s notice does not provide indicators of compromise, attacker infrastructure or independent technical confirmation for the LLMJacking characterization.

The incident matters because AI infrastructure sits close to enterprise data, even when the customer relationship is with Notion rather than Fireworks. A provider used for open-weight model inference can become a supply-chain choke point if its internal systems or third-party cloud environment are exposed. For customers, the practical risk is credential leakage inside pasted prompts, not broad workspace theft. Notion told affected users to treat exposed transcripts as leaked and rotate any passwords, API keys or credentials included in AI chats.