> ## Content Index
> Fetch the complete content index at: https://thecoverwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Breach at AI vendor Fireworks reaches Notion users' AI chat transcripts
- URL: https://thecoverwire.com/fireworks-notion-fourth-party-ai-vendor-cyber-aggregation/
- Published: 2026-11-12T06:12:51.000Z
- Updated: 2026-11-12T06:12:51.000Z
- Description: Data accessed at Fireworks, an AI supplier to Notion, included chat transcripts from fewer than 1% of Notion workspaces, Notion says.
- Author: CoverWire
- Tags: Cyber, #desk-risk

- Fireworks AI says an attacker used a security incident at a third-party cloud provider on 23 October to reach its development machines the next day; the data involved in its incident included billing information and, for certain customers, incomplete model weights and datasets.
- Notion says the data accessed included Notion AI chat transcripts from fewer than 1% of its workspaces, and has told affected customers to rotate any credentials they pasted into Notion AI during the incident.
- Notion says the incident "was not a breach of our systems". Fireworks says the evidence links the attack to a financially motivated group engaged in "LLMJacking".

A security incident at AI infrastructure provider Fireworks AI reached Notion AI chat transcripts from fewer than 1% of Notion workspaces, according to Notion.

The chain left Notion's affected customers handling a data exposure that started at a supplier to the app they use, not at the app itself. In CoverWire's analysis, a provider that Notion describes as powering "tens of thousands of customers" is a potential shared point of failure for the businesses whose data it holds.

In a bulletin last updated on 9 November, [Fireworks said](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=thecoverwire.com) a third-party cloud provider that hosted its R&D machines suffered a security incident on 23 October. On 24 October the attacker used it to reach Fireworks development machines and run an unauthorised workload "that led to additional customer data impact". Across the incident, Fireworks said, the data involved included billing and shipping addresses, invoice and payment history and, for certain customers, "a subset of incomplete model weights and datasets". Fireworks said it does not store payment card numbers and had not detected any impact to its Inference, Training SDK and Nexus products, which it said are zero-data-retention by default. Fireworks had [first disclosed](https://fireworks.ai/security/bulletins?ref=thecoverwire.com) unauthorised use of internal credentials in October.

[Notion's advisory](https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor?ref=thecoverwire.com), updated on 10 November, sets out how the exposure reached its users. Fireworks told Notion on 2 November that data had been accessed, which at first appeared to be synthetic test data. Notion cut its systems off from Fireworks and deleted its data there by the morning of 3 November. Fireworks then said on 6 November that customer data may have been accessed and confirmed the final dataset on 8 November. Notion contacted affected customers on 9 November.

That dataset included Notion AI chat transcripts used for a feature called Insights. Notion said that for the vast majority of affected workspaces the chats were not labelled with who wrote them or which workspace they came from. It has told affected customers to treat the data "as if it were exposed" and to rotate any passwords, API keys or other credentials pasted into Notion AI during the incident. Notion has disabled Insights and no longer serves open-weight models through Fireworks.

In CoverWire's analysis, whether a business's cyber cover responds to an event at a supplier's own subcontractor depends on how its wording defines the service providers it covers.

Fireworks said the evidence links the attack to a financially motivated group that sells tokens obtained through unauthorised access to large language models through illicit routing gateways, activity known as "LLMJacking". In a [2 November report](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models?ref=thecoverwire.com) that does not mention Fireworks, Google Threat Intelligence Group and Mandiant said incidents to which Mandiant responded in 2026 produced fraudulent charges exceeding $100,000 in a single day, with cumulative charges at some organisations reaching $1m before access was revoked.

Fireworks said its investigation, assisted by Palo Alto Networks Unit 42, is ongoing.

Related coverage: [Poisoned LiteLLM release was on PyPI for under two hours](https://thecoverwire.com/litellm-supply-chain-compromise-cyber-aggregation/); [France blames Iran's Revolutionary Guards for supermarket fridge hacks](https://thecoverwire.com/france-blames-iran-fridge-hacks-cyber-war-exclusion/).

## Sources

- [Fireworks AI: Update on October 2026 security incident (last updated 9 November 2026)](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=thecoverwire.com)
- [Fireworks AI: Security bulletins](https://fireworks.ai/security/bulletins?ref=thecoverwire.com)
- [Notion: Fireworks AI incident (updated 10 November 2026)](https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor?ref=thecoverwire.com)
- [Google Threat Intelligence Group and Mandiant: The Rise of LLMJacking (2 November 2026)](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models?ref=thecoverwire.com)