The Fireworks breach stopped being a vendor's data-category list this week. In an advisory reviewed on November 10, Notion, one of Fireworks' customers, confirmed that the accessed data included something with people on the other end of it: transcripts of chats between users and Notion AI.
The transcripts were not a random sample of Notion. They were chats processed for Insights, the feature that classifies a team's AI usage so the team can understand it. Notion used Fireworks for those classification jobs, and separately as a general inference provider to serve open-weight models inside the product. Fewer than 1% of workspaces are affected, per Notion, and it says it has contacted those customers. If you have not heard from Notion, it says it has not identified your workspace as affected, and no action is needed right now.
The word to read slowly
Notion's central reassurance is that, for the vast majority of impacted workspaces, the transcripts were "unattributable". Its definition is precise and narrow: the chats were not labelled with who wrote them or which workspace they came from, and they did not contain tool call results. Beyond the transcript text itself, nothing ties a chat back to a workspace, a user or a company.
That is a statement about the labels that were not attached. It is not a statement about the contents. The definition does not exclude identifying or sensitive information within the transcript itself. Notion therefore advises affected customers to inspect the impacted data and treat it as exposed, and to rotate sensitive information, passwords, API keys or other credentials pasted into Notion AI during the incident timeframe.
Disconnection preceded the additional dataset confirmation
The sequence in Notion's advisory deserves its own paragraph, because it shows where the lag in a vendor breach sits. Fireworks first notified Notion on the evening of November 2 that a small set of data had been accessed. Notion's review found synthetic testing data and no customer data. By the next morning, Notion had still disconnected from Fireworks entirely, deleted all of its data held in Fireworks' system and stopped all communication between the two companies' systems. That was the cautious move, taken on incomplete information.
The information then changed twice. On November 6, Fireworks told Notion that potential customer data may have been accessed after all. On November 8, Fireworks confirmed an additional dataset, and Notion's subsequent analysis of it found the chat transcripts. A customer that had severed the connection five days earlier received the fuller account only then. Notion's part of this was fast; the account it depended on arrived in stages.
Where this leaves the wider incident
Notion is a named downstream customer confirming end-user transcript exposure. Fireworks' own update, as reported by The Register on November 10, groups the impact into resource metadata, billing information and, for certain customers, datasets and incomplete model weights, and attributes the later intrusion to a third-party cloud provider compromised on October 23. It still does not state how many customers were affected across the two October attacks. Bloomberg, as reported by The Register, says Fireworks is working with Cursor and Harvey to assess impact. The sources reviewed contain no confirmation from either company that user content was exposed, and that distinction matters. One confirmed downstream disclosure is a fact. A customer list under assessment is not the same thing.
For teams that were not notified, Notion's message is that no action is needed right now, and its investigation continues. For everyone else who routes workplace conversations through an outside inference provider, the incident shows why customers should identify which subprocessors handle AI conversations, what they retain and how incident findings reach customers.
Sources
- [1] Notion, "Fireworks AI incident" — official security advisory (the <1% scope, the November 2/3/6/8 timeline, the definition of "unattributable", the Insights and inference uses of Fireworks, the disconnect and deletion, and the rotation guidance; read first-hand this run)Read source
- [2] The Register, "Fireworks AI gets burned twice as customer data exposure widens", November 10, 2026, 15:28 UTC (Fireworks' three data categories, the October 23 cloud-provider route, the October 9 first disclosure, and Bloomberg's reporting that Fireworks is also working with Cursor and Harvey)Read source
- [3] Cybersecurity News, "Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach, Affecting Customer Workspaces", November 10, 2026, 16:54 UTC (independent account agreeing with Notion's advisory on scope, timeline and the Insights pause; used as a cross-check)Read source
- [4] ALFW, "Fireworks Expands Breach Disclosure to Datasets and Incomplete Model Weights", November 9, 2026 (ALFW's prior coverage of Fireworks' expanded bulletin, built from Fireworks' own October and November bulletins)Read source