November 13, 2026. Notion says a security incident at Fireworks AI, an inference provider it used, affects fewer than 1% of Notion workspaces, and it told affected customers that "some unattributable chat sessions with Notion AI may have been exposed." It is now acting on credentials found inside those chats: according to its security advisory, Notion revoked exposed Notion API keys on November 11 and, on November 12, reported exposed third-party API keys to the vendors that issued them. For affected workspaces, Notion's advice is to rotate any passwords, API keys or other credentials pasted into Notion AI during the incident timeframe.
Key numbers
| Item | Number |
|---|---|
| Share of Notion workspaces affected (per Notion) | under 1% |
| Incident at a cloud provider hosting Fireworks R&D (one of two October incidents) | October 23, 2026 |
| Fireworks first notified Notion | November 2, 2026 |
| Notion disconnected from Fireworks | November 3, 2026 |
| Final impacted dataset confirmed | November 8, 2026 |
| Notion contacted affected customers | November 9, 2026 |
| Exposed Notion API keys revoked | November 11, 2026 |
| Third-party API keys reported to issuers | November 12, 2026 |
Notion's security advisory and help center, and Fireworks AI's November 9 bulletin, read on 13 November 2026.
What happened, in Notion's and Fireworks' words
- October. Fireworks has reported two October incidents. It first disclosed unauthorized use of internal credentials on October 9. Its November 9 update adds that a third-party cloud provider hosting its R&D machines had a security incident on October 23, which an unauthorized party used the next day to reach Fireworks development machines, and links the activity to "LLMJacking", selling stolen access to AI models. Neither company has said which incident reached Notion's data.
- November 2 to 4. Fireworks told Notion a small set of data had been accessed; Notion says that set was synthetic testing data. Notion disconnected from Fireworks by the morning of November 3 and deleted its data there on November 4.
- November 6 to 9. Fireworks said customer data may have been accessed, confirmed the final dataset on November 8, and Notion contacted affected customers on November 9.
- What was in it. Notion AI chat transcripts used for Insights, a feature that shows admins how members use AI. Notion has disabled Insights during the investigation.
Notion says the transcripts were, for "the vast majority of impacted workspaces", "unattributable", meaning not labeled with who wrote them or which workspace they came from. The Register reported that Reddit users pointed out the conversations themselves could contain identifying details, and Notion's key revocations show some chats contained API keys. Notion also says AI Meeting Notes data was not affected unless it was used as an input in a Notion AI chat.
Why zero data retention did not cover these chats
Notion's help center FAQ says zero data retention (ZDR) is its commitment for enterprise customers and "applies to the API requests we send to third party model vendors." Features that need stored prompts and replies, "including features like chat history and Insights", are "not intended" to be covered, and for Insights Notion "sent the stored requests and responses from Notion AI use to a third party model provider, Fireworks in this case." Fireworks, for its part, says it has "not detected any impact to Inference, Training SDK and Nexus, which are all zero data retention (ZDR) by default." In our view, the question to ask any AI vendor is which features store prompts and which subprocessors see that stored data, not only whether live model calls are ZDR.
What to do this week
- Check for an email from Notion. Notion says that if neither you nor your workspace owner heard from it, "no action is needed right now."
- If affected, download the data. Owners open Security incident review in the sidebar on a desktop browser. The member list CSV includes names, emails and row counts; the content CSVs need a verified domain.
- Rotate what the file flags. The annotated CSV's analysis column "flags potential sensitive information in each affected conversation so you can rotate affected credentials right away." Notion recommends treating the data "as if it were exposed."
- Add stored-data questions to vendor reviews. We suggest asking every AI tool for its subprocessor list and which features keep chat history.
If you are adding AI to client intake, where confidentiality matters, see our AI intake for law firms page, and our AI automation agency page for automations built on model APIs. For budgeting, see what an AI chatbot for business costs and our ChatGPT Business pricing guide.
Frequently Asked Questions
Notion says "this was not a breach of our systems." The incident was at Fireworks AI, an inference provider Notion used. Fireworks has reported two October 2026 incidents, and neither company has said which one reached Notion's data.
Notion AI chat transcripts used for the Insights feature, from fewer than 1% of Notion workspaces, may have been exposed. Notion says the vast majority were unattributable, but on November 11 it revoked exposed Notion API keys found in affected user messages.
Notion contacted affected customers starting November 9. If neither you nor your workspace owner heard from Notion, it says no action is needed right now. Affected owners can open Security incident review in the workspace sidebar on a desktop browser.
No. Notion says its enterprise ZDR applies to API requests sent to model vendors, and is not intended to cover features that store prompts and replies, such as chat history and Insights, which is where these transcripts came from.