Fireworks AI Breach Exposed Notion AI Chat Transcripts Stored Outside Zero Data Retention Terms

Quick Facts

• Attackers breached Fireworks AI twice in five weeks, with the second incident on October 23-24, 2026, exposing Notion AI chat transcripts used for its Insights feature.
• Notion confirmed the breach affected fewer than 1% of its workspaces, with most exposed transcripts unattributable to specific users or companies.
• Fireworks AI had a contractual zero data retention commitment with Notion, but data was retained anyway due to a policy carve-out for features requiring stored requests.

Notion disclosed that a security breach at its AI infrastructure vendor Fireworks AI exposed customer chat transcripts, raising questions about how zero data retention policies apply when third-party vendors store data to power specific product features. The full details emerged through a series of updated disclosures spanning nearly two weeks.

The incident involved two separate breaches at Fireworks AI within a five-week window. The first began October 6, 2026, when Fireworks detected misuse of internal credentials. The company revoked affected keys and service-account tokens and initially reported no evidence of access to customer models or datasets.

The second breach followed on October 23-24, 2026. According to Fireworks, a third-party cloud provider hosting its research and development machines was compromised, and attackers used that access to reach Fireworks systems the next day. Fireworks said it detected the activity the same day and closed known critical vulnerabilities by October 25.

Notion learned about the exposure on November 2, when Fireworks alerted the company to a dataset it described as containing only synthetic test data. Notion cut off traffic to Fireworks, deleted all data from the vendor's systems, and halted training runs by November 3.

The scope widened after that. On November 6, Fireworks said customer data might be involved. On November 8, it identified the specific dataset holding the chat transcripts. Notion's official advisory, updated November 10, confirmed that Notion AI chat transcripts processed for its Insights feature were among the exposed data.

"Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable," Notion stated in its advisory. The company said transcripts lacked labels identifying authors, workspaces, or companies and did not contain tool call results.

On November 9, Fireworks published an expanded bulletin revising its earlier assessment of Breach 1: attackers did access customer data, including account and billing information, and for a limited set of customers, secrets, datasets, and incomplete model weights. Payment card numbers were not stored by Fireworks and were not affected.

Fireworks CEO Lin Qiao said the apparent motive was not stealing model weights. "From what we see attackers are not after weights," Qiao said. The company confirmed it is working with affected customers including Notion and Cursor.

The breach exposed a significant gap between contractual data retention promises and actual data handling. Fireworks had signed a zero data retention agreement with Notion. But data was retained anyway because of how Notion's Insights feature works.

Notion's own zero data retention policy covers API requests sent to third-party model vendors for generating AI responses. The policy explicitly does not cover features that require storing requests and responses, including chat history and Insights. For Insights, Notion sent stored chat data to Fireworks for classification, and Fireworks held a contractual zero data retention commitment for that use. That commitment was not honored in practice.

For software companies relying on third-party AI vendors, the case illustrates a specific risk: contractual data handling guarantees may not reflect how data moves through vendor infrastructure when features require stored inputs. The breach reached data that sat at the boundary between real-time processing and stored classification jobs, a distinction that most vendor agreements do not address clearly.

Notion said any workspace not directly contacted by the company was not identified as affected. The breach is now Fireworks AI's second confirmed incident in under two months.