> Upon analysis of the new data, we discovered that it included unattributable Notion AI chat transcripts used for the Insights feature. Chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain any tool call results. Beyond the words in the chat transcripts themselves, the data contained no information that could specifically identify the workspace, user, or company.
> As a precaution, we recommend that you treat this unattributable data as if it were exposed. If anyone on your team pasted sensitive information like passwords, API keys, or other credentials into Notion AI during this timeframe, we recommend rotating them right away.
Okay, so the actual impact is quite interesting: they did not notify you if they could not attribute the transcripts to you! You should really treat anything sensitive sent to Notion AI as compromised because they are not sure where these transcripts came from.
Fireworks "datasets" are used for batch inference as well as training models. Notion mentioned that the leak was due to some feature they have to classify previous ai conversations. They probably uploaded these conversations as a 'dataset' to fireworks in order to take advantage of their large batch processing discount.
Does anyone actually use the AI features? $job switched off because they spent too much time on AI features we never used, and too little time making a text editor that wasn't painful to use
> “Unattributable” means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results. Beyond what’s in the chat transcript itself, there’s no information tying the chat back to a workspace, user, or company.
This is astonishing.
They’re saying “OTHER THAN THE ACTUAL CONTENTS OF YOUR CONVERSATION, NO INFORMATION WAS PRESENT”. That is not what unattributable really means and they’re trying to assert otherwise.
It’s trivial to identify the organisation or individuals involved in a conversation most of the time, but Notion are trying to make out that because the metadata wasn’t present, it’s no cause for concern.
That’s absolute bullshit and will give people a false sense of security. The contents of your conversation IS the critical information. Notion’s desktop app is very aggressive in prompting users to transcribe their calls and I imagine a large proportion do so by default. The potential for harm here is large.
I appreciate it’s Fireworks’ fault this happened, but Notion’s response destroys my confidence in them.
the whole incident response post feels like a huge cop-out. “abundance of caution”, the vendor is one of the biggest, so ofc it’s not our fault for choosing them… etc.
> Notion AI conversations from 2 members of your workspace may have been affected. Their conversations stay private to them. They have not been proactively emailed. In order for them to access their affected data, you must share this page with them so they can download their own.
Yeah spending the morning figuring out which users are affected and what data is involved. Time well spent. Thanks, Notion.
This is a strong reminder that a company's security is only as strong as its third-party integrations. Even when customer data is handled by trusted platforms, external AI vendors can introduce additional risks. Businesses need to carefully evaluate vendor security, limit the data shared with external services, and maintain transparency when incidents happen. As AI adoption grows, third-party risk management should become a core part of every company's security strategy.
> Upon analysis of the new data, we discovered that it included unattributable Notion AI chat transcripts used for the Insights feature. Chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain any tool call results. Beyond the words in the chat transcripts themselves, the data contained no information that could specifically identify the workspace, user, or company.
> As a precaution, we recommend that you treat this unattributable data as if it were exposed. If anyone on your team pasted sensitive information like passwords, API keys, or other credentials into Notion AI during this timeframe, we recommend rotating them right away.
Okay, so the actual impact is quite interesting: they did not notify you if they could not attribute the transcripts to you! You should really treat anything sensitive sent to Notion AI as compromised because they are not sure where these transcripts came from.
In all fairness, treating API tokens as compromised the moment you pasted them into an AI chat seems a reasonable default in general.
Yes, and they won't let admins see it either. It's insane.
On Openrouter the Fireworks AI is labeled as ZDR.
> Private: this provider does not train on prompts and does not retain prompt data.
So how come notion discovered that they actually stored the data?
> Upon analysis of the new data, we discovered that it included unattributable Notion AI chat transcripts
So Fireworks is ZDR by default, yet Notion configured (asked) Fireworks to retain data? Otherwise, how is there anything to leak?
On the main fireworks breach page, they also say some customer weights of models and datasets to train them were leaked.
Fireworks "datasets" are used for batch inference as well as training models. Notion mentioned that the leak was due to some feature they have to classify previous ai conversations. They probably uploaded these conversations as a 'dataset' to fireworks in order to take advantage of their large batch processing discount.
https://docs.fireworks.ai/guides/batch-inference
Can you really trust an AI company to be actually ZDR though
Not unless you can verify it through secure hardware attestation like with Apple’s private cloud compute system
you can stop after the word "Not"
Does anyone actually use the AI features? $job switched off because they spent too much time on AI features we never used, and too little time making a text editor that wasn't painful to use
> “Unattributable” means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results. Beyond what’s in the chat transcript itself, there’s no information tying the chat back to a workspace, user, or company.
This is astonishing.
They’re saying “OTHER THAN THE ACTUAL CONTENTS OF YOUR CONVERSATION, NO INFORMATION WAS PRESENT”. That is not what unattributable really means and they’re trying to assert otherwise.
It’s trivial to identify the organisation or individuals involved in a conversation most of the time, but Notion are trying to make out that because the metadata wasn’t present, it’s no cause for concern.
That’s absolute bullshit and will give people a false sense of security. The contents of your conversation IS the critical information. Notion’s desktop app is very aggressive in prompting users to transcribe their calls and I imagine a large proportion do so by default. The potential for harm here is large.
I appreciate it’s Fireworks’ fault this happened, but Notion’s response destroys my confidence in them.
If you’re looking for a Notion alternative you can self-host, I’m building Docmost. We launched on HN 2 years ago.
Website: https://docmost.com
GitHub: https://github.com/docmost/docmost
Does this reflect on Fireworks’ culture?
I used Notion as a form of social CRM and it really helped me out with that task. Now, all their contacts are out. Nice stuff Notion.
the whole incident response post feels like a huge cop-out. “abundance of caution”, the vendor is one of the biggest, so ofc it’s not our fault for choosing them… etc.
Forcing us to the Enterprise plan to see which members are affected huh? Classy move Notion.
> Notion AI conversations from 2 members of your workspace may have been affected. Their conversations stay private to them. They have not been proactively emailed. In order for them to access their affected data, you must share this page with them so they can download their own.
Yeah spending the morning figuring out which users are affected and what data is involved. Time well spent. Thanks, Notion.
We also have 2 members affected in our org. I wonder if this is a coincidence or just a fixed template.
It's a coincidence, we got the e-mail stating 1 user affected
This is a strong reminder that a company's security is only as strong as its third-party integrations. Even when customer data is handled by trusted platforms, external AI vendors can introduce additional risks. Businesses need to carefully evaluate vendor security, limit the data shared with external services, and maintain transparency when incidents happen. As AI adoption grows, third-party risk management should become a core part of every company's security strategy.