SecurityHack at AI vendor Fireworks exposed some Notion AI chats
Notion says a security incident at Fireworks AI, an outside company it used for some AI processing, exposed Notion AI Notion's built-in AI assistant that can answer questions, write or edit pages, and take actions inside a workspace. chat transcripts from fewer than 1% of Workspace In Notion, a workspace is a team's shared space: the account that holds its pages, databases and members.. Notion published its notice on 9 November (US time) and says it has contacted affected customers. If you haven't heard from Notion, it says your workspace has not been identified as affected and no action is needed for now.
What we learned
- Notion's timeline: Fireworks first warned it on the evening of 2 November, when the stolen data turned out to be test data only. By the morning of 3 November Notion had cut its systems off from Fireworks and deleted its data there. On 6 November Fireworks said customer data may also have been taken, and it confirmed that second dataset on 8 November.
- The exposed chats were copies used for Insights A weekly view for Notion workspace admins of how their team uses Notion AI. To build it, Notion used to send saved AI chats to an outside company to turn each one into a short description. Notion has now switched this feature off., a Notion feature that shows teams how they use AI. Notion says that for most affected workspaces they were 'unattributable': not labelled with the person or workspace, and without the results of tools the AI used. But anything a person typed into the chat is still in the text.
- Notion has switched off Insights while it investigates and has stopped using Fireworks to run Open weights When a company publishes the trained model file so anyone can download and run it on their own hardware. in Notion. It says no other Notion features were affected and that this was not a breach of Notion's own systems.
- Fireworks says the attackers are linked to a financially motivated criminal group behind 'LLMjacking When criminals steal access to someone else's AI services and use or resell it, leaving the victim with the bill.'. It found account and billing details were taken and, for some customers, secrets, datasets and unfinished models. It has hired Palo Alto Networks' Unit 42 to investigate.
Why it matters: If your workspace received Notion's email, review the affected chats inside Notion as instructed, treat them as exposed, and Credential rotation Replacing a password, API key or other login secret with a new one, so that any copy someone else has stops working. (passwords, API key A secret code that lets a program use a paid online service. Anyone who steals it can run up your bill.) that anyone pasted into Notion AI. Everyone else: treat any AI chat box like email and keep secrets out of it.