Japanese firms say Notion AI chat leak included client and staff names

✕Fri 13 Nov ‹›

Notion Notion security · Fri 13 Nov

Japanese firms say Notion AI chat leak included client and staff names

99people whose details TimeTree says were in exposed chats

Several Japanese companies now say the chat leak through outside vendor Fireworks AI may have exposed client names, and staff details, ITmedia AI+ reported on 12 November. It follows Notion's own notice of 9 November (US time), which we covered on 11 November.

Key points

Calendar app maker TimeTree said on 12 November that exposed chats included personal details of 99 people: 13 survey and interview participants, 5 client contacts and 81 executives and staff, plus some business information. It has reported the case to Japan's and says no passwords were included.
Security firms SecureNavi and LRM and agriculture firm Fager published notices on 11 November after hearing from Notion on 10 November. SecureNavi says client company names, contact names and the content of enquiries and meetings may be included; LRM says the affected chats were from 5 to 24 October.
Notion's Japanese advisory says that on 11 November it Notion found inside affected users' messages. That shows some people did paste secrets into AI chats; keys and passwords for other services are not revoked automatically.
All of these companies say their own systems were not broken into, and warn customers about scam emails or calls pretending to be them or Notion.

Why it matters: Notion says fewer than 1% of were affected, but these notices show what leaked chat transcripts mean in practice: client names and meeting notes. If your workspace got Notion's email, check the chats and change any keys or passwords that were pasted into Notion AI.

Sources (4)

Next · How teams use NotionCandidly's Notion agents update product docs whenever its code changes →

✕Thu 12 Nov ‹›

Notion How teams use Notion · Thu 12 Nov

Candidly's Notion agents update product docs whenever its code changes

1.5 hrsa week per product manager on docs (Candidly's figure)

In a short video posted on Notion's YouTube channel on 11 November, a product leader at Candidly explains how the company uses to keep its product documentation in step with its . This is a Notion-made customer story, and the figures are Candidly's own.

Key points

To start, filled in a 'product 101' template for each feature, guided by what the speaker calls 'codebase treasure maps' so the coding agent doesn't start from zero each time. Two people then reviewed and edited each document separately, to set a human-checked baseline.
Now, every time code is merged into the main development branch, agents read the change and suggest edits to the matching documents as comments. People review only the , and their replies are logged so the agent can learn what it got right and wrong.
Candidly says each product manager now spends about an hour and a half a week on documentation. Sales staff ask Notion questions, such as which options are offered, and get answers that cite the docs and the code.

Why it matters: If your documentation always lags behind your product, the part to copy is the human-checked starting point plus reviewing only the changes. Start with one feature and keep a person approving every .

Sources (1)

How Candidly uses agents to update product docs when code changes · Notion

Next · SecurityHack at AI vendor Fireworks exposed some Notion AI chats →

✕Wed 11 Nov ‹›

Notion Security · Wed 11 Nov

Hack at AI vendor Fireworks exposed some Notion AI chats

<1%of Notion workspaces affected (Notion)

Notion says a security incident at Fireworks AI, an outside company it used for some AI processing, exposed chat transcripts from fewer than 1% of . Notion published its notice on 9 November (US time) and says it has contacted affected customers. If you haven't heard from Notion, it says your workspace has not been identified as affected and no action is needed for now.

Key points

Notion's timeline: Fireworks first warned it on the evening of 2 November, when the stolen data turned out to be test data only. By the morning of 3 November Notion had cut its systems off from Fireworks and deleted its data there. On 6 November Fireworks said customer data may also have been taken, and it confirmed that second dataset on 8 November.
The exposed chats were copies used for , a Notion feature that shows teams how they use AI. Notion says that for most affected workspaces they were 'unattributable': not labelled with the person or workspace, and without the results of tools the AI used. But anything a person typed into the chat is still in the text.
Notion has switched off Insights while it investigates and has stopped using Fireworks to run in Notion. It says no other Notion features were affected and that this was not a breach of Notion's own systems.
Fireworks says the attackers are linked to a financially motivated criminal group behind ''. It found account and billing details were taken and, for some customers, secrets, datasets and unfinished models. It has hired Palo Alto Networks' Unit 42 to investigate.

Why it matters: If your workspace received Notion's email, review the affected chats inside Notion as instructed, treat them as exposed, and (passwords, ) that anyone pasted into Notion AI. Everyone else: treat any AI chat box like email and keep secrets out of it.

Sources (3)

Fireworks AI incident (security advisory) · Notion
Update on October 2026 security incident · Fireworks AI
AI company Fireworks says hackers stole data, billing info during October breaches · The Record

Next · Case studyKokuyo's engineers use Notion agents to review documents and find files →

✕Tue 10 Nov ‹›

Notion Case study · Tue 10 Nov

Kokuyo's engineers use Notion agents to review documents and find files

~100people in Kokuyo's engineering-led organisation using Notion (illustrative ITmedia image)

ITmedia Keyman's Net reported on 9 November how Japanese office-products maker Kokuyo uses Notion and in an engineering-led organisation of about 100 people. , requirements, designs and tasks now sit in one place, and help check documents. The article describes the setup but gives no measured results.

Key points

The engineering team, formed in July 2024, first kept minutes, requirement documents and designs across several services and its own file servers in mixed formats, so people had to ask colleagues where files were. It adopted Notion the same month, citing ease of use for staff new to IT tools.
A Notion does a quick first review of documents. The review and its results go into a feedback database; people re-check them, and what they confirm is fed back to the agent as new knowledge for the next review.
Developers also connect Claude to Notion through , so the AI can fetch Notion information and help with the searching, copying and updating that people used to do across several tools. Next, Kokuyo wants AI to prompt people to fill gaps and to tidy duplicated notes.
The headline says scattered documents dropped to 'zero', but the article gives no before-and-after figures. Treat it as a description of how the system is set up, not proof of time saved.

Why it matters: The reusable idea is the loop: store an agent's review results, have a person confirm them, and feed confirmed lessons back in. A team can start with one document type and a simple feedback database before trusting an agent with wider edits.

Sources (1)

コクヨが開発部門の「資料散乱」をAIでゼロに「Notion」をどう使ったか？ · ITmedia Keyman's Net

Today

Thursday 12 Nov

Wednesday 11 Nov

Tuesday 10 Nov

Japanese firms say Notion AI chat leak included client and staff names

Key points

Candidly's Notion agents update product docs whenever its code changes

Key points

Hack at AI vendor Fireworks exposed some Notion AI chats

Key points

Kokuyo's engineers use Notion agents to review documents and find files

Key points