Fireworks AI Confirms Another Incident; Notion Addresses Affected AI Chat Transcripts

The Fireworks AI security incident expanded with confirmation of another unauthorized access event. On November 9, the company said that after an October 23 incident involving an external cloud provider, an attacker accessed Fireworks AI development machines the following day and launched an unauthorized task. Notion also confirmed the impact; it used Fireworks to operate some Notion AI features.

According to Fireworks, resource metadata and billing information were affected in the incident. For a limited group of accounts, parts of incomplete model weights and datasets may also have been affected. The company said it does not store payment card numbers.

The Fireworks AI security incident also affected customer data

According to Fireworks, the timeline begins with an incident involving an unnamed external cloud provider on October 23. The following day, an attacker accessed Fireworks development machines and launched an unauthorized task. The company is continuing its investigation, so the full scope of affected accounts and data may still change.

Fireworks did not announce the cloud provider’s name or the attacker’s identity. It said only that available indicators point to a financially motivated group associated with so-called LLMJacking, the abuse of access to large language models. However, the company does not present this attribution as definitive confirmation of the perpetrator’s identity.

According to Fireworks’ current notice, it detected no further successful unauthorized access to the platform used by customers after October 25. The company revoked and replaced credentials, isolated affected systems, and temporarily disabled self-service dataset uploading and downloading for Batch Inference and dataset training.

Notion: Insights feature chat transcripts were affected

Notion confirmed that fewer than 1% of workspaces were affected. The incident involved Notion AI chat transcripts used by the Insights feature. The company said these transcripts did not contain tool-call results, such as Notion page content or external data.

According to Notion, most affected transcripts were not labeled with a specific user, workspace, or company. This does not mean the conversation content could not have contained sensitive data: users could have entered their own text into the chat, including credentials or other internal information.

Notion contacted the owners of affected workspaces, disabled the Insights feature, and stopped using Fireworks to operate open-weight models. It has not been confirmed that the affected transcripts were disclosed or subsequently misused.

Recommendation for affected organizations

Notion recommends that affected organizations treat chats as potentially exposed. If users entered passwords, API keys, or other credentials into Notion AI, they should rotate them.

The case is a supplier incident affecting customer data. It shows that risk in AI services may also arise from infrastructure and model suppliers, not only directly from the service used by the end organization.

What happens next

Further findings from the Fireworks forensic investigation will be important, particularly any clarification of the scope of affected data and customers. It also remains open whether the company will disclose the technical cause of the intrusion, the cloud provider’s identity, or confirmation that the data was misused. Notion may provide a more precise period from which the affected chats originated or update the number of affected workspaces.

Verified and updated: 11/10/2026 15:27