Notion AI Data Breach Exposes Customer Chat Transcripts Through Third-Party Provider

Businesses are increasingly using artificial intelligence to summarize meetings, organize information, draft documents and handle everyday work. But as AI becomes part of business operations, another question deserves attention: what happens to the information employees share with these tools?

A recent security incident involving Notion and its AI infrastructure provider, Fireworks AI, has brought that question into focus.

Notion has confirmed that attackers accessed a dataset held by Fireworks AI containing Notion AI chat transcripts from fewer than 1% of Notion workspaces. The incident did not involve a confirmed breach of Notion's own systems. Instead, the exposure occurred through a third-party provider supporting parts of its AI services.

Although the affected portion of workspaces is relatively small, the incident raises important questions about how AI conversations are processed, stored and protected beyond the applications people use directly.

What happened?

Notion disclosed the incident in a security advisory following notifications from Fireworks AI.

According to Notion, Fireworks first notified the company on November 2, 2026, that malicious actors had accessed a small dataset. Notion's initial investigation found synthetic AI testing data, with no customer conversations involved in that dataset.

As a precaution, Notion disconnected its systems from Fireworks, deleted its data from the provider's systems and stopped communications between the two companies by November 3.

However, the situation changed on November 6, when Fireworks informed Notion that customer data might also have been accessed.

On November 8, Fireworks confirmed the affected dataset. Notion's subsequent review found that it included AI chat transcripts used for its Insights feature.

The company contacted affected customers on November 9 and disabled Insights while its investigation continued.

Notion also confirmed on November 11 that it had revoked exposed Notion API keys discovered in affected users' messages during its investigation.

What information was exposed?

The affected material consisted of Notion AI chat transcripts processed for the Insights feature.

Insights was designed to help workspace administrators understand how their teams used AI. Notion used Fireworks AI to perform classification tasks supporting this feature.

Notion says that, for the vast majority of affected workspaces, the transcripts were unattributable. This means they were not labeled with the identity of the person who wrote them or the workspace they came from. The transcripts also did not include tool-call results.

However, this distinction matters: unattributable does not mean the conversation contained no sensitive information. The actual words entered into an AI conversation could still contain business details, internal discussions or other information a user chose to share.

Notion has not published an exact number of affected transcripts or workspaces. It says fewer than 1% of its workspaces may have been affected.

The company also says no other Notion workspace data or features were affected.

Why was Fireworks AI involved?

Notion is the application users interact with, but its AI capabilities rely on external infrastructure and model providers.

Fireworks AI provides infrastructure that allows companies to run AI models and process AI workloads. Notion used the provider for classification jobs connected to Insights and as an inference provider for open-weight models within its product.

This arrangement is not unusual. Many software companies depend on external providers for computing, storage, analytics and AI processing.

The difficulty is that information does not always remain within the application where it was originally entered. Depending on how a feature works, some information may be sent to another service for processing.

That creates another layer of security responsibility.

A company may have strong protections around its own application, but the security of its customers' information can also depend on the systems, access controls and data-handling practices of its suppliers.

What has Notion done since the incident?

Notion says it has taken several steps to limit further exposure.

These include disconnecting its systems from Fireworks, deleting its data from the provider's systems, disabling the Insights feature and stopping the use of Fireworks to serve open-weight models within Notion.

The company has also contacted customers it identified as affected and provided instructions for securely retrieving and reviewing the relevant data.

Notion says that if a customer or workspace owner has not received a notification, the workspace has not currently been identified as affected and no action is required at this stage. Its investigation remains ongoing.

For affected customers, Notion recommends treating the exposed information as compromised. It also advises rotating passwords, API keys and other credentials that may have been pasted into Notion AI during the incident.

What should businesses learn from this incident?

The incident offers a useful reminder for organizations adopting AI tools: data protection needs to extend beyond the application itself.

Businesses should consider the following practices:

1. Review what employees share with AI tools.

Employees should understand that prompts and conversations may contain confidential business information. Sensitive credentials, private customer records and unnecessary personal information should not be pasted into AI assistants.

2. Understand third-party AI providers.

Organizations should know which external services process their information, what data those services receive and how that information is handled.

3. Review data retention and deletion policies.

A provider's retention commitments are important, but businesses should also understand which features store data, how long it remains available and what happens when a service is discontinued.

4. Treat API keys and passwords as sensitive information.

Credentials should not be shared through ordinary AI conversations. If credentials may have been exposed, they should be rotated and reviewed for unauthorized use.

5. Include AI suppliers in security assessments.

Vendor security reviews should cover AI infrastructure, data processing, access permissions, incident notification procedures and the provider's ability to demonstrate its security controls.

The bigger issue: AI security does not stop at the application

The Notion incident is not evidence that every AI tool is unsafe. It does, however, demonstrate why businesses should pay attention to the infrastructure behind the products they use.

AI services often depend on several interconnected providers. Each connection introduces another place where information may be processed or stored, and another security relationship that needs to be understood.

For businesses, the lesson is straightforward: choosing a secure AI application is only part of protecting the information employees share with it.

Organizations also need visibility into the services operating behind the application, the data those services handle and the controls in place when something goes wrong.

As AI becomes more deeply integrated into everyday business operations, that responsibility will become increasingly important.