Notion AI Chat Exposure: Review Your Affected Transcripts

BleepingComputer reported on 11 November that a breach at Fireworks AI exposed Notion AI chat transcripts. Notion's help page explains that Fireworks supplied model inference and classification for Insights, a feature showing administrators how their workspace uses AI. Stored requests and responses were sent to that provider for analysis.

Notion says it disconnected Fireworks, deleted data in the vendor's system and stopped sending traffic by 3 November. Insights has been disabled during the investigation. These containment steps do not establish that previously accessed data has been recovered from an attacker.

Open Notion through your usual trusted route in an up-to-date desktop browser. For notified workspace owners, Notion gives the path: workspace sidebar, question-mark menu, Security incident review. The affected-data review is not available on mobile.

Owners can download an affected-member list and copy a link that lets members review their own affected data. Full affected-content downloads for owners require a verified workspace domain. If you are a member rather than an owner, ask your workspace owner for the review link; do not assume that an absent owner-only control means your chats are unaffected.

Review the exposed text and replace any passwords, API keys or other credentials it contains. For workplace secrets, involve the responsible IT or security team so replacement and revocation are coordinated. Keep downloaded transcripts within your organisation's approved secure storage rather than uploading them to another chatbot for analysis.

Notion says chat transcripts include model inputs or outputs written to the chat. AI Meeting Notes audio, transcripts and summaries were not affected unless used as an input in a Notion AI chat transcript. Do not interpret the incident as exposure of every meeting recording or every workspace document.

For the vast majority of affected workspaces, Notion says it did not add metadata identifying the user, workspace or company to the transcripts sent to Fireworks. The text itself may still identify people or reveal secrets. Notion also distinguishes exposed content from context added to its annotated review exports: seeing a workspace or user identifier in that added context is not evidence that the identifier was leaked.

Notion's explanation distinguishes zero-retention commitments for third-party model API requests from product features that deliberately store chats. It says Fireworks had also contractually committed to zero retention for Notion's use of its platform, but the investigation found retained data at the endpoints used. A retention promise should not be treated as proof that a stored conversation cannot be exposed.

A VPN protects the network connection between your device and its VPN server. It does not control what Notion or an AI supplier stores, erase exposed transcripts or replace compromised credentials. The useful response here is to check the affected data and deal with any secrets it contains—not buy a VPN as a breach remedy.