Fireworks AI Discloses Two Breaches in 18 Days; Notion Chat Transcripts Hit

Fireworks AI has disclosed two security incidents in 18 days, and the second put customer chat data inside the blast radius. Notion confirmed its investigation found Notion AI chat transcripts used for the Insights feature in a dataset Fireworks provided on November 8, 2026. The episode now serves as a live test of how far one AI vendor's failure travels into products built on top of it.

What happened, and when?

The first incident surfaced on October 6, 2026. Fireworks identified unauthorized use of internal credentials. An unauthorized third party accessed environment variables (configuration settings that carry secrets outside code) used in evaluation jobs in a limited number of customer accounts.

The second began October 23. A third-party cloud provider hosting Fireworks R&D machines suffered a compromise. A day later, an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload. Fireworks has not named the provider.

Notion's advisory fills in the downstream picture:

• November 3 — Notion disconnects its systems from Fireworks.
• November 4 — Notion deletes its data in the Fireworks system.
• November 8 — Fireworks provides Notion the affected dataset.
• November 9 — Notion contacts impacted customers.
• November 10 — Insurance Journal and The Register publish coverage.
• November 12 — TechCrunch reports hackers accessed Notion customers' chat transcripts.

The gap between the October 23 provider compromise and the November 8 dataset handoff is 16 days. Notion cut its connection five days before it knew what the dataset held. Disconnecting early cost little; waiting for a forensic readout would have cost days of exposure.

What data was confirmed affected?

Fireworks' update lists two clear categories and one narrower one:

• Resource metadata — identifiers, display names, descriptions, creation times.
• Billing information — billing and shipping addresses, invoice and payment history, account balance, credit usage.
• Model weights and datasets — a subset of incomplete weights and datasets, for certain customers only.

Payment card numbers sit outside the scope because Fireworks did not store them. The first investigation found no evidence of access to customer models, datasets, training data, personal information or inference traffic "within the Fireworks security perimeter or control." That phrase describes only what Fireworks could see inside its own boundary. It says nothing about machines hosted by a third-party cloud provider. Two weeks later, that gap became the second incident.

Billing data deserves attention. Addresses, invoice history and credit usage let an attacker map who a company is, how much it spends on AI inference and when. A phishing email quoting a real invoice date and amount looks routine to an accounts-payable clerk.

How did Notion's transcripts end up exposed?

Notion said the affected dataset included Notion AI synthetic testing data and, separately, chat transcripts used for the Insights feature. For the vast majority of impacted workspaces, the transcripts were unattributable — a reader could not easily tie them to a specific customer. That reduces harm without erasing it. A transcript still reveals what employees ask an AI assistant to do with company documents.

Notion's sequence is the model to study: cut the connection, delete the data, notify customers after the facts exist. Many companies reverse that order and spend days arguing over wording while data sits in someone else's environment.

What did Fireworks say on the record?

Fireworks wrote in its bulletin: "A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23." That sentence places the root cause outside the company's own walls.

The company told BleepingComputer: "We detected this activity on the same day, and followed our incident response processes to take immediate remediation measures and close known critical vulnerabilities." Same-day detection is a meaningful claim. It describes detection of activity, not full scope.

Fireworks also said: "As of October 25, we have not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use." The wording covers one platform on one date. It does not cover the R&D machines, and it does not cover data already taken.

Remediation included revoking credentials and service accounts, restricting network pathways, isolating affected systems, tightening storage access, and engaging Palo Alto Networks' Unit 42. Fireworks has not published the forensic report.

What remains unconfirmed?

A person familiar with the matter described the breach as involving "tens of thousands of files." That figure did not come from an identified Fireworks statement. Fireworks' own wording — a subset of incomplete model weights and datasets for certain customers — is narrower. The company has not said how many customers were affected, which cloud provider was compromised, or what the unauthorized workload did. Claims about attribution and motive belong in the rumor column.

Why does this matter for enterprise buyers?

A Notion customer who never heard of Fireworks could still have had chat content in the dataset. Traditional vendor questionnaires rarely ask where a vendor's research machines live or who administers them. Those questions decided the outcome here. Expect procurement teams to demand hosting disclosure, contract notice windows that start at detection, and deletion rights on demand — the exact power Notion used on November 4. Insurance Journal's coverage signals underwriters are watching.

The takeaway: the weakest link in an AI stack may sit two vendors away from the product a customer actually uses.