Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach, Affecting Customer Workspaces
Notion AI chat transcripts exposed due to a breach at Fireworks AI.
Notion has confirmed that a security incident at Fireworks AI led to the exposure of Notion AI chat transcripts for less than 1% of its customer workspaces. These transcripts were used by the 'Insights' feature to track AI usage. Notion stated that its own systems were not breached and no other features were affected. Affected customers have been notified and advised to review their data and change credentials pasted into Notion AI.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fireworks AI?
Get an email when a new story names Fireworks AI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNotion's exposure of AI chat transcripts stemmed not from a flaw in its own systems, but from a breach at Fireworks AI, a third-party provider powering the Notion AI 'Insights' feature. This is a classic supply chain security failure: Notion's customers trusted Notion, but their data was at risk through a vendor Notion trusted. The incident highlights that sensitive customer data — including potentially credentials pasted into AI chats — can be exposed even when your own infrastructure is secure. Organizations must treat third-party data processors as an extension of their own attack surface and apply commensurate due diligence and contractual controls.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.