Fireworks AI Security Incident May Affect Less Than 1% of Notion Workspaces

Overview

Notion has disclosed a security incident involving Fireworks AI, a third-party infrastructure provider used for some of its AI workloads. Following an investigation by Notion’s security team, the company determined that less than 1% of Notion workspaces may have been affected. The potentially exposed material consists of some Notion AI chat transcripts used in the product’s Insights feature.

Notion says the transcripts were “unattributable”: they did not identify the person who wrote them or the workspace they came from. The data also did not include tool-call results. Apart from the words contained in the transcripts, Notion says there was no information linking them to a particular user, workspace, or company. The company further states that no other data from affected workspaces was involved.

Key points

• The reported scope is limited. Fewer than 1% of Notion workspaces may be affected. Workspace owners who have not received a notice from Notion do not need to take action at this time.
• The exposed material may include chat text only. The transcripts lacked workspace and user labels and did not contain tool-call results. Their remaining risk depends on what users wrote in the chats.
• Fireworks was used for several AI functions. Notion relied on it for classification jobs supporting Insights, which helps customers understand their AI usage, and as an inference provider for open-weight models served inside Notion.
• Notion has suspended the relevant integrations. The company disabled Insights during the investigation and stopped serving open-weight models through Fireworks.
• Affected customers have a review path. Workspace owners can use the desktop app or web browser to open “Security incident review” from the sidebar help menu. The feature is not available on mobile. Enterprise customers can access CSV exports and an annotated analysis version, while other plans receive a page or link that lets members review their own affected records.

What users should do

Notion recommends treating the affected data as exposed. If a user pasted passwords, API keys, or other credentials into Notion AI during the relevant period, those credentials should be rotated immediately. Additional metadata shown to affected customers for investigation, such as user associations, was not part of the exposed dataset; it was added by Notion to support impact analysis.

The incident highlights a broader issue in AI product design: the security boundary extends beyond the application provider. Model inference, classification, monitoring, and related processing may be handled by external infrastructure companies. Even when an AI platform limits workspace access, a compromise at a service provider can create another route to sensitive content.

For enterprise AI deployments, vendor mapping and data-flow documentation should therefore be treated as operational necessities rather than compliance paperwork. Customers need to know which prompts are sent to outside providers, how long they are retained, whether they can be attributed to an organization, and how quickly a vendor can notify them of an incident. Data minimization, sensitive-content detection, credential rotation, and clear customer-facing review tools are equally important.

Notion’s disclosure provides a defined scope and a way for affected owners to inspect the records. However, the practical impact still depends on the text users entered into those chats. The event is a reminder that convenience features built on third-party AI services require continuous supply-chain oversight.

Source: Hacker News