Notion AI chats were exposed in a breach at Fireworks AI. How to check yours

What happened

On November 9, 2026, Notion told customers that a dataset intruders reached at Fireworks AI, a company it used to run AI models, “included Notion AI chat transcripts used for the Insights feature,” and that the incident affects “<1% of Notion workspaces.” The same day, Fireworks updated its bulletin from October: the intruders had reached more than it first said, including billing details and, “for certain customers, a subset of incomplete model weights and datasets.”

Fireworks presents it as one incident with an update. Bloomberg headlined it as Fireworks notifying customers “of its second hack in weeks.” The order of events, from the two companies’ own pages:

Date	What happened
Oct 6	Fireworks finds its internal credentials being used without permission
Oct 9	Its first bulletin: environment variables “used in evaluation jobs” were reached in a limited number of accounts
Oct 23	A cloud provider that hosted Fireworks’ research machines has its own security incident
Oct 24	The intruder uses it to reach Fireworks’ development machines and run “an unauthorized workload”; Fireworks detects it the same day
Nov 2	Fireworks tells Notion a small set of data was accessed; Notion finds only synthetic test data
Nov 3	Notion disconnects from Fireworks and deletes its data there
Nov 6	Fireworks tells Notion that customer data may have been accessed
Nov 8	Fireworks confirms the final dataset
Nov 9	Notion contacts affected customers, and Fireworks updates its bulletin
Nov 10	Notion updates its notice “for style and clarity”: “No changes have been made to previously reported facts”

Fireworks links the attackers to “a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as ‘LLMJacking.’” Google’s threat intelligence team described the practice on November 2.

What was exposed

At Notion, it’s chat transcripts: “Any input to or output from the model that was written to the chat,” in its help article’s words. AI Meeting Notes weren’t affected “unless it was used as an input in a chat transcript with Notion AI,” and Notion says no other feature was. For most affected workspaces the chats were “unattributable”: “the chats weren’t labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.” That still leaves whatever a chat says about itself, and Notion asks owners to treat the data “as if it were exposed.”

Insights is the tool that sent the chats there. Notion’s settings page describes it as helping owners “understand how your team uses AI,” among settings for owners and admins on the Business and Enterprise plans, and it now reads “Insights is temporarily paused.” Notion hasn’t said whether every affected workspace was on one of those plans. Its FAQ adds that it used data volunteered through its Learning and Early Access Program “to experiment with training task-specific models on Fireworks” and has “halted all training runs,” without saying whether that data was taken.

At Fireworks, the affected internal application gave access to three kinds of data: resource metadata such as names and descriptions; billing information, “such as billing and shipping addresses, invoice and payment history, account balance, and credit usage”; and, for some customers, datasets and incomplete model weights. “Payment card numbers are not stored by Fireworks and were not impacted.” It has turned off self-serve dataset uploads and downloads for Batch Inference and dataset-based training while it investigates.

Who it affects

If you use	What’s been said	What to do
Notion AI, and Notion contacted your workspace	Chats sent to Fireworks for Insights were exposed	Review the data, replace secrets
Notion AI, with no notice	“We haven’t identified your workspace as affected”	Nothing yet; Notion says it will contact you if that changes
Fireworks, with a notice	Billing data, and for some, secrets, datasets or incomplete weights	Follow the notice
Fireworks, with no notice	Not identified as affected	“No incident-specific action is currently required”
Cursor	Named by Fireworks; nothing from Cursor	Watch for an email from Cursor

Fireworks says on its homepage that it is “trusted by 10,000+ companies globally,” Cursor and Notion among the logos, and it hasn’t published which were affected. It told Bloomberg it is “actively working with our customers to manage the incident, including Notion, Cursor, and others,” as Seeking Alpha quotes it. That says Cursor is involved in the response, not that Cursor data was taken.

We found no statement from Cursor as of November 11. Its security page says “Critical incidents are communicated via email to affected users.” Its data use page says that with Privacy Mode on, “Cursor maintains zero data retention (ZDR) agreements with all providers,” and that with it off, “Some of our inference providers may temporarily access and store model inputs and outputs to improve our inference performance.” Neither page names Fireworks.

How to check your Notion workspace

1. Open the review. In the workspace sidebar, click ?, then Security incident review. Notion says to use a desktop browser on the latest version: “This data is not accessible on mobile.”
2. See who’s affected. Download affected members makes a CSV with each person’s name, email, membership status and “the count of how many rows of affected data are related to the user.”
3. Let members see their own. Copy link makes a link that shows each member only their own affected data.
4. Read the content, if your domain is verified. Owners get affected_content.csv, the affected data “exactly as it was accessed,” and an annotated copy whose analysis column “Flags potential sensitive information in each affected conversation.”
5. Replace what was pasted. “If you or anyone on your team pasted sensitive information like passwords, API keys, or other credentials into Notion AI during this timeframe, we recommend rotating them right away.” Revoke each one with whoever issued it; deleting the chat doesn’t stop a copied key from working.

Zero data retention, and where it didn’t hold

Notion promises its Enterprise customers zero data retention for the requests it sends model vendors to answer Notion AI. Its FAQ says that promise doesn’t cover features that need stored chats, “like chat history and Insights.” For Insights, Notion sent those stored chats to Fireworks for analysis, and “Fireworks provided us with a contractual commitment to zero data retention for our use of its platform. Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”

Fireworks’ account differs. Its October bulletin said “Fireworks does not store prompts or outputs by default, as our platform is ZDR,” and its update says it has “not detected any impact to Inference, Training SDK and Nexus, which are all zero data retention (ZDR) by default.” Neither company has said which Fireworks service the Insights jobs used, or why data was kept. Notion says it is now auditing “critical vendors — such as inference providers, and data processors.”

What hasn’t been said

• How many workspaces, beyond fewer than 1%, or which plans they were on.
• Which dates the chats cover. Notion’s advice refers to “this timeframe” without giving it.
• Why the data was kept, given the retention promise.
• Which other Fireworks customers lost data, and whether Cursor is one.
• Which cloud provider was breached on October 23.
• Whether the data has been sold or published. Neither company says.

Keeping prompts on servers you chose

Every AI feature sends your words to a model somewhere, and a vendor’s vendor can hold them too, as Insights shows. A retention promise is a contract you can’t check from outside, so the dependable rule is the old one: keep passwords and keys out of chats, as our help guide describes.

For coding agents, Enjoy has no AI model of its own and never sees your conversations: it hands them to the agent on your computer, which sends its work to the provider you signed in with, under that provider’s rules (what AI providers see). To send nothing at all, use a local model, which Enjoy runs through OpenCode. We’ll update this memo when Notion, Fireworks or Cursor say more.