Notion AI chats surface in Fireworks breach, testing what zero retention covers

Editor’s Note: Workspace software company Notion said Nov. 10 that a dataset affected by a breach at AI inference company Fireworks AI held Notion AI chat transcripts from fewer than 1 percent of Notion workspaces. Notion says Fireworks retained data from the endpoints Notion used despite a contractual commitment to zero data retention; Fireworks’ public bulletins do not address that account. Fireworks said Nov. 9 that its investigation found impacts to billing information and, for a limited set of accounts, to secrets, datasets and incomplete models, and that one intrusion came through a third-party cloud provider hosting its research machines. For the vast majority of affected workspaces, Notion said, the transcripts carried no author or workspace label.

For cybersecurity, information governance and eDiscovery professionals, the episode shows copies of AI conversations held by an inference provider one tier below the application, under retention promises whose scope differed at each layer.

Watch for Fireworks’ further findings, for statements from other customers and for vendors’ answers on which features retain prompts. Legal AI company Harvey was among customers Fireworks told of the hack, The Information reported, and Harvey said none of its customers’ data was affected, according to accounts by MLQ.ai and Sovereign Magazine.

News Analysis – Cybersecurity Beat

Notion AI chats surface in Fireworks breach, testing what zero retention covers

ComplexDiscovery Staff

Notion AI chat transcripts from fewer than 1 percent of Notion workspaces were in a dataset affected by a breach at AI inference company Fireworks AI, Notion said Nov. 10.

Those transcripts record conversations workers had with an AI assistant in their own workspace, and Notion says Fireworks retained data from the endpoints Notion used despite a contractual commitment to zero data retention for Notion’s use of its platform. The gap between what a vendor promises and what its systems keep is now a records question as much as a security one.

Two intrusions, one widening disclosure

Fireworks, which has over 10,000 customers according to The Record, said it identified unauthorized use of internal Fireworks credentials on Oct. 6. Its first bulletin, published Oct. 9, said an outsider had reached the environment variables behind evaluation jobs in a limited number of customer accounts. Fireworks said it believed credentials kept there as secrets, including API keys and tokens, had been captured in some of them. At that point Fireworks said it had found no sign that anyone reached customer models, datasets or training data, personal information, or inference traffic such as prompts and outputs, which it said it does not keep by default.

Those secrets could open systems well beyond Fireworks. The company advised affected customers to rotate any third-party credentials at the issuing provider and to check that provider’s access logs, warning that “removing a stored secret alone does not invalidate the underlying credential.” Its public bulletins do not say whether any exposed credential was used against a customer’s own systems.

The company’s Nov. 9 update replaced that early picture with a wider one. Fireworks said its investigation had since found impacts to account and billing information, and, for a limited set of accounts, to secrets, datasets and incomplete models. It also disclosed a second route in. A third-party cloud provider that hosted Fireworks research and development machines suffered a security incident Oct. 23, the company said. On Oct. 24, the intruder used that foothold to get into Fireworks development machines and “run an unauthorized workload that led to additional customer data impact,” Fireworks said. The company said it caught that activity the same day and, as of Oct. 25, had found no further sign of a successful break-in on the platform its customers use.

According to the update, the affected internal application gave access to resource metadata such as identifiers and display names, and to billing information including billing and shipping addresses, invoice and payment history, account balances and credit usage. It also reached a subset of incomplete model weights and datasets for certain customers. Fireworks said it does not store payment card numbers and that none were affected. The company notified law enforcement, engaged Palo Alto Networks Unit 42 for forensic analysis and, while the investigation runs, has switched off customers’ own uploading and downloading of datasets for batch inference and dataset-based training.

Fireworks said “the evidence indicates links to a cybercriminal threat actor group” that is financially motivated and seeks to sell tokens from unauthorized access to large language models to illicit routing gateways, a practice known as LLMJacking. The update does not say whether that link covers the Oct. 24 activity, and Bloomberg News, as relayed by Seeking Alpha, reported that Fireworks did not say who was responsible for the latest incident.

What Notion found in the data

Notion’s own timeline shows how the scope moved for one customer. Fireworks warned Notion on the evening of Nov. 2 that malicious actors had reached a small batch of data, which Notion first found to hold only synthetic testing data. By the morning of Nov. 3, Notion said, it had cut its connection to Fireworks, and on Nov. 4 it deleted all its data in the Fireworks system. On Nov. 6, Fireworks told Notion that potential customer data may have been accessed, and on Nov. 8 it confirmed the final impacted dataset and gave it to Notion.

That dataset held Notion AI chat transcripts used for a feature called Insights, which gives workspace administrators a view of how their members use AI. According to Notion’s Help Center FAQ on the incident, Insights worked by sending Notion AI requests and responses that Notion had already stored to Fireworks, which ran the analysis. Notion also relied on Fireworks, which it calls a general inference provider, to run open-weight models inside its product. It has disabled Insights while it investigates and no longer serves open-weight models through Fireworks.

For the vast majority of affected workspaces, Notion said, the transcripts were unattributable, meaning nothing labeled the author or the originating workspace, and no tool call results were included. For those transcripts, Notion said, nothing beyond the content ties a chat to a workspace, user or company, and a chat that names a client, a matter or a colleague can carry that link inside its own text. Notion itself can still make the connection. For owners of workspaces with a verified domain, it offers a copy of the affected data annotated with workspace, user and conversation identifiers, which it says were not part of the exposed data.

The content did carry credentials in some cases, and Notion has acted on that. On Nov. 11, the company said, it revoked exposed Notion API keys that its investigators found in affected user messages, and on Nov. 12 it reported exposed third-party API keys from the same messages to the vendors that issued them. It has also advised customers to rotate any passwords, API keys or other credentials pasted into Notion AI during the timeframe of the incident, advice that reaches whatever systems those credentials open. Notion has not said what period the affected chats cover.

Three zero-retention promises, three different scopes

Chat content could be reached only because something at Fireworks kept it. Notion’s FAQ says that was not supposed to happen. Fireworks “provided us with a contractual commitment to zero data retention for our use of its platform,” Notion wrote, adding that during its investigation “we learned that data was retained from the Fireworks endpoints that we used.” Fireworks’ public bulletins do not mention Notion or address that account. Neither company has said which Fireworks feature held the transcripts.

Notion’s own zero-retention promise to its enterprise customers is narrower than the commitment it describes from Fireworks. The FAQ says that promise covers the API requests Notion sends to outside model vendors to generate Notion AI responses. It is “not intended to cover” features such as chat history and Insights, where Notion must store requests and responses to deliver the feature. Looking ahead, Notion said, it is auditing critical vendors, among them inference providers, to confirm that those vendors follow data minimization practices such as zero data retention policies.

Fireworks’ public documentation, as of Nov. 12, describes the company’s own default. It says Fireworks “does not log or store prompt or generation data for open models, without explicit user opt-in.” Prompts and outputs sit in temporary memory rather than persistent storage, for the length of a request or, when prompt caching is active, for several minutes, according to the documentation. The Nov. 9 update invokes that default, saying Fireworks had detected no impact to its Inference, Training SDK and Nexus products, which it describes as zero data retention by default. VentureBeat reported that Chief Executive Lin Qiao’s post on X about the incident carved batch inference out of that list.

The default has edges. The documentation adds that “a few features do store customer content,” naming stored responses, batch jobs and training, and its Responses API keeps conversation data for up to 30 days under the default store setting. An account-wide Zero Data Retention policy that rejects those storing operations, including batch inference jobs, evaluation jobs and dataset uploads, is available on Enterprise accounts and is off by default, the documentation says. Turning it on does not delete content already stored.

A custodian one tier below the application

Those layered promises carry the practical lesson for information governance and eDiscovery teams. A data map that lists Notion as the home of employees’ AI chats would show the original records but not, by itself, the copies sent to Notion’s inference provider for analysis. The same blind spot can arise wherever a product’s model provider retains content, because the application vendor signs the customer contract while the model host may hold a copy.

The notice chain shows how far that tier sits from the customer. Word of the exposure passed through two companies, Fireworks to Notion and then Notion to its customers, who heard Nov. 9, though neither company has said which intrusion reached the Insights transcripts. Notion’s advisory describes the incident as not a breach of its own systems, while still contacting the customers whose workspaces were affected.

The copies matter differently for preservation than for breach response. Because Insights sent chats that Notion had already stored, Notion’s deletion of its data at Fireworks on Nov. 4, two days after the first warning, removed copies held by the subprocessor rather than Notion’s own stored records. Fireworks then supplied the impacted dataset Nov. 8, four days after that deletion, and Notion’s analysis of it is what turned up the chat transcripts. The subprocessor’s copy is still the one that shows what an intruder could reach. Organizations should know in advance which subprocessors hold copies of AI chat content, who controls their deletion once a breach is reported, and whether the vendor will consult them first.

Legal AI faces the same question

The legal market has a direct stake in those answers. Harvey describes Tenet as its first post-trained open-weight model, built from a Kimi K3 base that it post-trained together with Fireworks, and Fireworks’ customer page says the work ran on the Fireworks Training API. Harvey also says none of its post-training work used customer data. The Information reported Nov. 9, citing people familiar with the matter, that Fireworks had told some large customers, including Harvey, about the second hack, according to accounts of the paywalled story by MLQ.ai and Sovereign Magazine. Harvey said none of its customers’ data was affected, Sovereign Magazine reported, citing The Information. Fireworks’ bulletins do not mention Harvey, and a search of Harvey’s website on Nov. 12 found no statement about the incident.

Fireworks’ documentation says training workflows “can persist datasets, checkpoints, traces, and trained model artifacts,” and its Nov. 9 update said datasets and incomplete model weights were reached for certain customers. Those statements, together with Notion’s account, frame the questions law firms and corporate legal departments can put to any legal AI vendor built on a hosted model. Which provider runs inference and training, and which of that provider’s features retain prompts or documents? Does the vendor’s own zero-retention promise cover every feature, and has it verified the commitments its providers made? How quickly will the vendor pass along a subprocessor’s breach notice, and will it preserve affected copies before deleting them?

The conversations in that dataset reached Fireworks through Notion, by way of a feature built to help administrators understand how their own people use AI, under a vendor commitment that Notion says did not hold. When the next model host discloses a breach, will your organization’s data map show who held your people’s AI conversations, or will you learn it from someone else’s notice?

News Sources

• Fireworks October 2026 security incident (Fireworks AI)
• Update on October 2026 security incident (Fireworks AI)
• Fireworks AI incident (Notion)
• Notice about the Fireworks AI incident that may impact some Notion workspaces (Notion)
• Zero Data Retention policy (Fireworks AI)
• Zero Data Retention (Fireworks AI)
• Data Security (Fireworks AI)
• Harvey Tenet: Post-Training Kimi K3 for Legal Work (Fireworks AI)
• Harvey Tenet Research Preview (Harvey)
• AI company Fireworks says hackers stole data, billing info during October breaches (The Record)
• Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats (The Hacker News)
• Fireworks AI discloses new breach after cloud provider hack (BleepingComputer)
• Notion Customer Data Compromised in Fireworks AI Hack (SecurityWeek)
• Attackers breached the Fireworks AI storage where Notion AI chats sat outside zero data retention (VentureBeat)
• Nvidia-backed Fireworks AI hit by second cyber incident, exposes data: report (Seeking Alpha via TradingView)
• Fireworks AI confirms hackers stole customer data; Notion says AI chat transcripts were exposed (MLQ.ai)
• New Fireworks Hack Threatens $1 Billion Business (The Information via Dealroom)

Assisted by GAI and LLM Technologies

Additional reading

• France ties October supermarket fridge sabotage to Iran’s IRGC and seeks arrest warrants
• ENISA’s update advisory turns the patch pipeline into an evidence trail
• Britain’s cyber agency warns of a possible surge, and its own incident figures raise a question
• Supermarket freezer attacks reach at least six European countries, and the record linking them to US base failures stays thin
• Microsoft finds 2 North Korean groups using ARTEX, a tool that alone cannot name an attacker
• With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project
• Estonia’s cyber authority saw no state-sector PHP crisis as three state institutions shut or restricted services
• AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.