Vendor leak exposes Notion AI conversations in less than 1% of workspaces

Notion confirmed a Notion AI leak: transcripts of conversations with the platform's AI assistant may have been accessed by criminals after an attack on Fireworks AI, a company that processed some of this data. According to Notion's official notice, less than 1% of workspaces were affected.

The exposed conversations were used by the Insights feature and, according to the company, did not have labels identifying the author or workspace. They also did not include results from tools triggered by the assistant. Notion states that no other workspace data was affected.

How the attack happened

Fireworks AI was used by Notion for Insights classification tasks and to run open-source models within the product. According to The Register, Fireworks suffered two incidents in October.

In the first, detected on October 6, attackers used unauthorized internal credentials and accessed API keys and tokens of some customers. In the second, a cloud provider hosting Fireworks' research machines was compromised on October 23. The next day, the attackers used that access to enter the company's development systems.

In this second attack, resource metadata, addresses, billing histories, and account balances were accessed. For some customers, incomplete parts of model weights and databases were also downloaded. Payment card numbers were not stored and were not affected. Fireworks suspects financially motivated criminals who resell illegal access to AI models.

Fireworks CEO Lin Qiao said the apparent target was not the models and that "most downloads were partial and interrupted." The company did not disclose how many customers were affected in total.

What Notion did

Notion severed the connection with Fireworks on November 3. The vendor notified about possible access to customer data on November 6 and confirmed the affected data set on November 8. Since then, Notion disabled Insights, stopped using Fireworks to run open models, deleted the data that was on the vendor's system, and contacted the owners of the affected workspaces.

The company asks affected customers to treat the conversations as exposed. Reddit users pointed out that even without formal identification, the chat content itself may contain names, projects, and company data.

What users should do

Those who have not been contacted by Notion, either personally or through the workspace owner, do not need to do anything for now, according to the company. In affected workspaces, the owner can review the conversations via the help menu in the sidebar, under the security incident review option. This feature only works on the desktop browser, with the latest version of Notion, and is not available on mobile.

• If you pasted passwords, API keys, or other credentials into Notion AI during this period, change them immediately.
• Enterprise plan owners can download a spreadsheet with the affected conversations; on other plans, the owner can share a link with the affected members.

The Notion notice does not include specific information about users in Brazil.