# Fireworks AI: the breach reached customer datasets and Notion AI chats

> Fireworks AI's October breach reached customer datasets, and Notion found its AI chats retained despite a zero-retention deal.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Incident, Supply chain
- **Published by:** Fireworks AI
- **Disclosed:** 2026-11-09
- **Affects:** Fireworks AI, Notion, Notion AI
- **Research by:** Fireworks AI security team, Notion security team (Notion)
- **Primary source:** https://fireworks.ai/security/bulletins/october-2026-security-incident-update
- **Page:** https://theinjection.dev/items/fireworks-october-incident-datasets-notion/

Fireworks AI widened its October breach disclosure on November 9, 2026 to cover billing data and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says its AI chat transcripts were retained there.

## What happened

Fireworks AI updated its October 2026 security bulletin on November 9, 2026, after first reporting on October 9 that the incident involved secrets used in evaluation jobs. The update adds account and billing information, and for a limited set of accounts, secrets, datasets and incomplete models. Notion published a separate notice the same week saying fewer than 1% of its workspaces may be affected.

## How it works

A third-party cloud provider hosting Fireworks research and development machines had its own incident on October 23, 2026, and the next day an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload. Fireworks ties the activity to a financially motivated group that resells LLM tokens obtained through unauthorized access, a pattern Fireworks calls LLMJacking. Notion states it held a contractual zero data retention commitment from Fireworks, then learned that data was retained on the Fireworks endpoints Notion used.

## Who is affected

Fireworks customers whose accounts held secrets, datasets or incomplete model weights are in scope, and Fireworks says affected customers are being notified directly with impact details. Fireworks states that Inference, Training SDK and Nexus are zero data retention by default and that no impact to them has been detected. Notion names its Insights feature, its open-weight model serving and its Learning and Early Access Program as the paths that sent data to Fireworks.

## What to do

Rotate any secret stored on Fireworks and treat affected datasets as exposed. Notion tells workspace owners to open Security incident review in the Notion sidebar to see what was involved, and to rotate any password or API key pasted into Notion AI during the affected period.

## Quick facts

- **Disclosed:** October 9, 2026, updated November 9, 2026
- **Data involved:** Account and billing information; for a limited set of accounts, secrets, datasets and incomplete models
- **Not affected:** Inference, Training SDK and Nexus, which Fireworks says are zero data retention by default
- **Entry point:** A third-party cloud provider incident on October 23, then Fireworks development machines on October 24
- **Notion scope:** Fewer than 1% of Notion workspaces, per Notion
- **Notion cut-off:** Notion disconnected its systems from Fireworks as of November 3
- **Status:** Investigation ongoing with Unit 42; self-serve dataset uploads and downloads disabled

## Sources

1. [Fireworks Bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident-update)
2. [Notion Notice](https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor)
3. [Wiz Black October](https://www.wiz.io/blog/black-october-for-ai-developer-platforms)