By Thorsten Meyer | November 12, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Updated: November 13, 2026. Notion has corrected one date (it deleted its data at Fireworks on November 4, not November 3) and says it reported exposed third-party API keys to the companies that issued them. Details in the update below.
Key takeaways
- What is new: Notion has expanded its notice about the Fireworks AI breach. Chat transcripts from Notion AI were in a dataset the attackers accessed, and on November 11 Notion “revoked exposed Notion API keys that were found in affected user messages”.
- The uncomfortable detail: Notion says Fireworks gave it “a contractual commitment to zero data retention”. Then: “Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
- Who is affected: Notion puts it at “fewer than 1% of Notion workspaces”. If neither you nor your workspace owner has heard from Notion, it has not identified your workspace as affected.
- What to do if you are affected: treat the data “as if it were exposed”, review it under Security incident review, and rotate any passwords, API keys or other credentials pasted into Notion AI during the incident.
- What is not known: which Fireworks system kept the data, how long it was kept, how many people are affected, and whether other Fireworks customers had the same problem.
Products Worth Considering
Bose QuietComfort Ultra Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones with Spatial Audio, Driftwood Sand
DJI Osmo Mobile 8 Phone Gimbal with Mic Mini Transmitter, Infinity Black
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
As an affiliate, we earn on qualifying purchases.
Update, November 13: Notion reports leaked third-party keys and corrects a date
Notion updated its security advisory again. Three things are new:
- Keys for other services: “on November 12 we reported exposed third-party API keys found in affected user messages to the vendors that issued them.” This comes on top of the Notion API keys it revoked on November 11. Notion does not say how many keys were involved or which vendors it contacted.
- A corrected date: Notion now says it disconnected its systems from Fireworks by the morning of November 3 and that “on November 4, Notion deleted all its data in the Fireworks system.” Earlier versions of the advisory put the deletion on November 3. Notion says it “updated the timeline in this Security Bulletin based on our continued investigation.” Its help page still dates both steps “As of November 3rd”.
- Members can check their own chats: “In most workspaces”, affected members can now open their own affected content under Security incident review, without waiting for a link from the owner. Owners with a verified domain can remove members’ access to these files, which Notion says “does not delete any data”.
Fireworks has not changed its own bulletin, which still reads “Last updated November 9, 2026”. As of this update, I found no public statement from a regulator and no filed lawsuit about the incident.
What it means: if anyone on your team pasted keys for other services into Notion AI, the company that issued a key may now contact you or act on it. Do not wait for that. Rotate those keys yourself.
A follow-up with one new, hard question
Two days ago I wrote about how the Fireworks AI breach widened to datasets and model weights. That piece covers the timeline at Fireworks, the two ways in, and what Fireworks customers should check. I won’t repeat it here.
Since then, Fireworks has not changed its own bulletin. Its update still reads “Last updated November 9, 2026”. Notion has. On November 10 and November 11 it updated its security advisory and rebuilt its help page about the incident. BleepingComputer reported on the update on November 11 under the headline “Notion says Fireworks breach exposed customer AI chat transcripts”.
The headline fact is the chat transcripts. The more important fact for any business is buried in Notion’s FAQ: the data was not supposed to be there at all.
What Notion says was exposed
Notion used Fireworks for two jobs. It ran “classification jobs” for a feature called Insights, which shows workspace administrators how their teams use AI. It also used Fireworks “as a general inference provider to serve open-weight models inside our product.”
The exposed data came from the Insights side. Notion writes that the dataset Fireworks gave it on November 8 “included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable.”
“Unattributable” is doing a lot of work in that sentence, so here is Notion’s definition: “the chats weren’t labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.”
That sounds reassuring until you read Notion’s next answer. A transcript includes “Any input to or output from the model that was written to the chat.” Anyone who typed a customer name, a contract detail or a password into the chat box put it in the transcript. Notion itself recommends “a thorough analysis of the affected data as the specific input or output from the model may contain sensitive data.”
Notion says AI Meeting Notes, “including audio, transcripts, or summaries, was not affected unless it was used as an input in a chat transcript with Notion AI.” And “No other Notion features were affected.”
The zero-retention promise that did not hold
Zero data retention, or ZDR, is the promise that an AI provider does not keep your prompts and outputs after it has answered. Many companies buy AI features on exactly that promise.
Notion’s FAQ now explains two limits of it.
First, ZDR at Notion covers live requests to model vendors. It “applies to the API requests we send to third party model vendors we use to generate responses to Notion AI requests.” Features that need stored data are outside it. Notion names “chat history and Insights” and writes: “Our zero data retention commitments are not intended to cover these use cases where we are required to retain the data to deliver the feature.”
Second, for Insights, Notion sent “the stored requests and responses from Notion AI use” to Fireworks for analysis. Fireworks, Notion says, “provided us with a contractual commitment to zero data retention for our use of its platform.” Then the key sentence: “Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
Fireworks’ own update says it has “not detected any impact to Inference, Training SDK and Nexus, which are all zero data retention (ZDR) by default.” It lists datasets among the data that was accessed “for certain customers”. Neither company says which Fireworks system kept Notion’s data, or why. I could not reconcile the two statements from what is published, so I am putting both side by side rather than guessing.
Notion’s response: “we are doing an audit of critical vendors — such as inference providers, and data processors — to verify that they abide by data minimization practices, including zero data retention policies.”
Notion’s clock
Notion now publishes its timeline as a table. Here it is, plus its newest entries:
- November 2, evening: Fireworks tells Notion that “a small set of data had been accessed by malicious actors.” It turns out to be “Notion AI synthetic testing data”.
- November 3, morning: Notion has “disconnected its systems from Fireworks, and stopped all communication between its systems and Fireworks.” Its help page adds that it has “halted all training runs.”
- November 4: “Notion deleted all its data in the Fireworks system.” Earlier versions of the advisory dated this step to November 3.
- November 6: Fireworks says “malicious actors may have accessed potential customer data.”
- November 8: “Fireworks confirmed the final impacted dataset.”
- November 9: “Notion reached out to impacted customers.”
- November 11: Notion “revoked exposed Notion API keys that were found in affected user messages during our investigation.”
- November 12: Notion “reported exposed third-party API keys found in affected user messages to the vendors that issued them.”
In other words, people pasted Notion API keys into AI chats, those chats sat at a third party, and the keys stayed valid until Notion found them nine days after Fireworks’ first alert. The count is mine, from November 2 to November 11.
One more detail is new in the FAQ. Customers in Notion’s Learning and Early Access Program (LEAP) “volunteer their data to help Notion test new AI technology”, and Notion says that “In the past, we used this volunteered data to experiment with training task-specific models on Fireworks.” Notion does not say whether any LEAP data was in the affected dataset.
What Notion tells affected customers
Notion’s advice to affected customers has two parts: look at the data, and act as if others have seen it.
- Find the data. Workspace owners go to “workspace sidebar → ? → Security incident review”, in a desktop browser on the latest version of Notion. “This data is not accessible on mobile.”
- See who is affected. Every affected workspace owner can download a CSV of affected members, with names, emails, user IDs and “the count of how many rows of affected data are related to the user.”
- See what was exposed. Owners with a verified domain can download the affected content “exactly as it was accessed”, plus an annotated version that flags “potential sensitive information in each affected conversation”. Notion says the added annotations were not part of the exposed data.
- Let members check their own chats. Owners can share a link that shows each member only their own affected data.
- Rotate credentials. “If you or anyone on your team pasted sensitive information like passwords, API keys, or other credentials into Notion AI during this timeframe, we recommend rotating them right away.”
If you have not heard from Notion: “we haven’t identified your workspace as affected, and no action is needed right now. Our investigation is ongoing.”
What this means for businesses
This is the subprocessor problem in its plainest form. You sign with one SaaS vendor. That vendor sends your data to an AI inference provider. The inference provider runs on a cloud provider. Notion’s case shows three things a contract alone does not fix.
1. Read what “zero data retention” actually covers. At Notion, ZDR covered live model requests, not features that store data, such as chat history and analytics. Ask every SaaS vendor which AI features store prompts and outputs, and which third parties receive that stored data.
2. A contractual promise is not a technical control. Notion had Fireworks’ commitment in writing, and the data was still retained. Ask your vendors how they verify ZDR at their AI providers: audits, logs, deletion tests. Notion says it is now doing that audit itself.
3. Your staff’s chat boxes are a secrets store. The keys Notion revoked on November 11 were in “affected user messages”. Treat AI chat logs like any other system that can leak credentials: train people not to paste keys, scan for them, and rotate what you find.
If you are a Notion workspace owner who was notified, the to-do list is short: open Security incident review, download what you can, share the member link, and rotate anything that looks like a credential.
What this means for users
If you use Notion AI and your workspace owner forwards you a link, open it on a desktop and read your own chats. Change any password or key you see in them. If you hear nothing, Notion says it has not identified your workspace as affected and no action is needed right now.
The broader lesson works for every AI assistant at work: what you type into the box does not stay in the box. It can be stored for features you never think about, and passed to companies you have never heard of.
What we don’t know
- Which Fireworks system kept the data. Notion says data “was retained from the Fireworks endpoints that we used”. Fireworks says its ZDR products showed no impact. Neither names the system.
- How long the data was kept, and when it was accessed.
- How many people are affected. Notion gives a share, “fewer than 1% of Notion workspaces”, not a number of users or chats.
- How many API keys were revoked or reported, which vendors were told, and whether any keys were used by the attackers.
- Whether LEAP data was involved.
- Whether other Fireworks customers had stored data where they expected none. No other customer has published a notice that I could find.
- Who the attackers are. Fireworks links the activity to a financially motivated LLMjacking group but does not name it.
The bottom line
Notion’s update is a model of disclosure in one way: it tells customers exactly what to download and what to rotate. It also admits what many companies would rather not, that a promise of zero retention did not match what was stored. For businesses, the takeaway is simple and a little uncomfortable: the AI features you buy are only as private as the least careful company in the chain, and “zero data retention” needs to be checked, not just signed.
For context, read how stolen AI tokens turn into cash on the black market.
I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.
Sources
- Notion: “Fireworks AI incident”, security advisory, notion.com/security/advisories, with update entries of November 11 and November 13, 2026
- Notion Help Center: “Notice about the Fireworks AI incident that may impact some Notion workspaces”, notion.com/help, as of November 13, 2026
- Fireworks AI: “Update on October 2026 security incident”, security bulletin, last updated November 9, 2026, fireworks.ai/security/bulletins
- BleepingComputer, Bill Toulas: “Notion says Fireworks breach exposed customer AI chat transcripts”, November 11, 2026
Researched and drafted with AI assistance, including Anthropic’s Claude. No company named here reviewed or sponsored this article. This article is for information only. It is not legal or security-consulting advice. Statements as published by Notion and Fireworks AI as of November 13, 2026; check their pages for later updates. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown.
