All week my inbox has been filling with the same question from clients: what happened with Notion and Fireworks AI, and should I worry? I can answer from the inside, because my own workspace was one of the ones Notion notified. So here is the notion fireworks ai breach explained in layman terms: what leaked, what did not, how to check your workspace, and the habits I now recommend to every team that uses AI.

What happened, in layman terms

Fireworks AI is an inference provider. It runs AI models for other companies, especially open-weight models, and it serves more than 10,000 businesses. Notion was one of them. When attackers got into Fireworks' systems in October, some Notion AI chat transcripts were sitting in a dataset they could reach.

Notion says fewer than 1% of workspaces may have been affected, and it has been clear that this was not a breach of Notion's own systems. The leak came through a vendor, not through your workspace.

Why a Notion vendor had your AI chats in the first place

Notion used Fireworks for two jobs: serving some open-weight models inside Notion AI, and running classification for Insights, the feature that shows workspace owners how their team uses AI.

When you chat with Notion AI, the model answers you and, under normal inference, that exchange is not stored by Fireworks. Insights is different. To classify usage, chat transcripts were sent over and stored for processing. That stored dataset is the side door. The everyday feature was fine; the analytics feature built on top of it was the exposure.

The timeline, from Fireworks to your inbox

Fireworks published two security bulletins, and Notion published its own advisory. Put together:

1. October 6: Fireworks identifies unauthorized use of internal credentials. Secrets stored in some customers' evaluation jobs were accessed.

2. October 23 and 24: a third-party cloud provider hosting Fireworks' R&D machines is breached, and attackers reach development machines with billing data, some datasets, and unfinished model weights.

3. November 2: Fireworks alerts Notion.

4. November 3: Notion disconnects from Fireworks, deletes its data there, and halts training runs.

5. November 6: Fireworks tells Notion customer data may be involved.

6. November 8: Fireworks confirms the dataset that included Insights transcripts.

7. November 9: Notion emails affected workspaces.

Fireworks says the likely motive is LLMjacking: stealing access to AI models and reselling it. The investigation is still open.

What leaked and what did not

Exposed: Notion AI chat transcripts, meaning what was typed into an AI chat and what the model answered, exactly as written.

Not exposed, per Notion: your pages, your databases, your workspace structure, and tool call results. AI Meeting Notes were not affected unless you pasted them into an AI chat. If you rely on AI meeting notes like I do, that is good news.

One honest caveat: I have seen people report tool call output in their own exported files, so I am not yet sure what Notion's definition of "tool call results" covers. Check your own file rather than assuming.

Unattributable is not the same as anonymous

Notion describes the transcripts as unattributable: no username, no workspace name attached. That is true. However, when I reviewed my own exported data, and helped clients review theirs, the transcripts contained exactly what people paste into AI: client names, project details, pricing, notes about specific people. Strip the username and the content can still point straight at you. If you ever shared private information with Notion AI and that chat was in the dataset, it is identifiable by its contents.

Zero data retention (ZDR) has limits

Notion's notice includes a line I think every Enterprise buyer should read twice. Zero data retention is an Enterprise commitment that covers model requests used to generate answers. Apparently, it does not cover features that need stored requests, like chat history and Insights. Notion also says Fireworks had a contractual zero retention commitment for Insights, and the data was retained anyway. Some are talking about an agreement breach right here.

So "we have ZDR" is not a full answer. The real question is which features store your data, and where.

How to check if your workspace was affected

Here is the path I walked through with my clients:

1. Use a desktop browser on the latest Notion version. Mobile does not show this data. Chrome worked for me where Safari did not.

2. Open the sidebar, click ?, then Security incident review (at the bottom of the sidebar for most workspaces).

3. Click Download affected members to get a CSV of everyone affected, with row counts.

4. If your domain is verified, download the affected content files, including an annotated version that flags possible sensitive information.

5. Without a verified domain, members review their own content, so use Copy link and ask each affected person to check theirs.

What to do if your data is in the file

• Rotate every password, API key, or token you ever pasted into a Notion AI chat. Do it at the issuing service, not just in Notion.

• Read your transcripts carefully. Look for client names, financial details, and anything you would not put in an email to a stranger.

• Warn the people named. The real risk now is targeted phishing: someone using real project details to impersonate you to your clients.

Who else was affected

Fireworks named Notion and Cursor as affected customers, and Harvey, the legal AI platform, was also notified. October alone saw a surge of incidents across AI developer platforms. This is a vendor-chain problem, not a Notion-only one.

Notion's response was fast: it cut the connection, deleted the data, paused Insights, and stopped serving open-weight models through Fireworks. It also says it is auditing critical vendors for data minimization.

The habits I now give every client

Sort what you share with AI into three tiers:

• Share freely: context, workflows, plans, structure.

• Strip first: client names, emails, pricing. Replace them with roles or placeholders.

• Never paste: passwords, keys, secrets.

Then five habits for confident AI use:

1. Keep client details in pages and let AI reference them, instead of pasting them into chats.

2. Turn on confirmation before AI makes web requests.

3. Keep AI personalization generic.

4. Use Enterprise controls for sensitive clients, knowing exactly what zero retention covers.

5. Subscribe to Notion's subprocessor alerts so vendor changes never surprise you.

A shared prompt library helps here too. When the team reuses vetted prompts, fewer people improvise with raw client data.

Trust AI, but know what you gave it

Opening that export is a useful exercise even if you were not affected. Ask yourself honestly what you have typed into AI chats over the past year, and whether you would be comfortable seeing it in a CSV. That is the real lesson. The goal is not zero trust in AI. The goal is knowing exactly what you handed it.

If you want a second pair of eyes on how your workspace and AI settings handle sensitive data, book a workspace audit and I will walk through it with you.

Sources: Notion security incident notice · Fireworks October security bulletin · Fireworks November update · The Register coverage · BleepingComputer coverage

All content in this article is grounded in real customer interactions and real projects we’ve worked on, the analysis, insights, and ideas are entirely my own. AI tools may have been used to help process raw data, or to reformulate and refine parts of the writing.