Notion tells AI users to rotate secrets after Fireworks breach

Any password, API key or token a user pasted into Notion AI may now be in a third party's hands. Notion told affected customers on 9 November to treat those secrets as public and rotate them.

Notion wrote a public page about a security incident involving a third-party AI vendor. That vendor is Fireworks AI, an infrastructure company that hosts models. Notion used Fireworks for part of Notion AI. The chats affected are a small share of all Notion workspaces. Users who pasted secrets should still act. The workspace list is not the only guide.

What Notion says happened

Notion gives three dates. On 3 November, Notion disconnected from Fireworks. On 6 November, Fireworks told Notion that malicious actors may have accessed customer data on its systems. On 8 November, Fireworks confirmed the dataset to Notion.

Notion then ran its own check. It says less than one percent of Notion workspaces may be affected. It has contacted the owners of those workspaces directly.

The exposed data is Notion AI chat sessions. Notion says the chats were not labelled with who wrote them or which workspace they came from. The transcripts did not contain tool call results.

What a Notion AI user has to do

Notion's advice is short. Rotate any password, API key or other credential pasted into Notion AI during the affected period. Do it now.

The missing workspace labels do not help a user here. A chat still carries the text a person pasted in. If that text held a working credential, treat that credential as public now. A missing label does not make a leaked key safer. A stranger with the text can still try it.

What this is the second of this week

Fireworks AI is the same vendor at the centre of a breach reported by The Information two days earlier. That report named Harvey, a legal AI startup, as a Fireworks customer whose data was exposed. The Notion disclosure widens the picture: at least two large AI products built on Fireworks had customer data touched by the same incident. Fireworks has not published its own public write-up at the time of Notion's page. Its customers are speaking first.

A team building on a shared model-serving vendor should ask one question this week. Does the vendor hold chat data in a way the team's own security policy would accept? For many teams, that policy forbids a third party holding plaintext credentials.

Source

Security incident involving a third-party AI vendor (Notion)

New Fireworks hack threatens $1 billion business (The Information, paywalled)