Fireworks AI Breach Exposed Notion AI Chat Transcripts

Fireworks AI has confirmed that a cyberattack exposed some of its customers' data, and Notion is among the affected companies. According to TechCrunch, about 1% of Notion's customers were affected.

The intrusion began upstream of Fireworks itself. The attacker breached Fireworks' cloud provider and used that access to reach a Fireworks development system. From there, the hackers stole billing information belonging to Fireworks customers, along with some datasets.

For Notion, the exposure centres on Notion AI's Insights feature. The hackers took chat transcripts from Notion AI customers who had used Insights. Those transcripts hold every input sent to the model and every output it returned, so the stolen material is the prompt and completion content itself, not only session metadata such as timestamps or user IDs.

Notion acted before the disclosure. On November 3, it disconnected its systems from Fireworks, deleted data stored on its own side, and stopped all connectivity between the two companies.

Fireworks says it believes the attackers are financially motivated. Its assessment is that the group intends to sell tokens obtained by breaching access to large language models (LLMs). In this context, tokens are the credentials that let a caller run a model under someone else's account, so reselling them is a direct route to profit. That makes an inference provider, a company that runs models on behalf of others, an attractive target in its own right.

This is the second breach affecting Fireworks in two months. A security incident in October 2026 came before the November one. Two incidents in eight weeks at the same provider put its security posture under scrutiny from every customer that routes production traffic through it.

The broader context here is the architecture. A development system with a route to customer billing records and datasets points to a familiar gap between development and production trust boundaries. A cloud provider compromise that spreads into a model-serving vendor is a supply-chain problem, not a single-tenant one. Customers building on hosted inference have to treat the provider's control plane, its cloud dependencies and its development tooling as part of their own attack surface.

In my view, the more instructive detail is Notion's response. A customer that can sever connectivity, purge the data it holds and cut off the vendor within days has a meaningful containment lever, and many integration designs do not expose that lever cleanly. The harder question for the wider market is what a prompt-and-completion log is worth to an attacker, and how much of that material vendors and customers keep by default. Retention limits, field-level encryption of chat content and scoped credentials for inference endpoints shrink the damage when a vendor is breached. They are unglamorous, well-understood engineering, and the incident gives teams a concrete reason to check whether those controls are in place for their own deployments.