Notion AI chat records exposed in breach of contractor Fireworks
November 13, 2026 · 1 min read
Notion disclosed on November 9 that Fireworks, a contractor handling AI processing, suffered an unauthorized access incident that may have exposed some chat records from Notion AI to third parties. Less than one percent of Notion workspaces were affected by the breach.
The exposed chat records were used in Insights, a feature that tracks Notion AI usage. Most affected workspaces lacked labels identifying who wrote the messages or which workspace they came from. The records did not include the results of tools that the AI had called. However, the text content of the chats themselves was included in the exposed data.
Notion contacted affected customers on November 9. Customers who received notification can review the exposed records within their workspace by following email instructions. Notion recommends that customers who pasted authentication credentials such as passwords or API keys into Notion AI during the affected period should change or reissue them.
The company did not specify the exact timeframe during which the unauthorized access occurred or provide details about how Fireworks discovered the breach. Notion also did not disclose whether any data beyond chat records was accessed during the incident.