Fireworks AI Breached Again: Notion AI Chat Transcripts Exposed

What happened

Fireworks AI said in a security update on November 9 that a third-party cloud provider hosting its research and development machines was compromised on October 23, and attackers used that access the next day to reach Fireworks development systems and run an unauthorized workload. The company said it suspects links to financially motivated criminals involved in LLMJacking, the practice of selling unauthorized access to AI models through illicit gateways.

Notion confirmed on November 10 that Fireworks notified it on November 6 that customer data may have been accessed, and confirmed on November 8 that the new dataset included Notion AI chat transcripts used for the Insights feature; under 1% of workspaces were affected, and the transcripts were unattributable for the vast majority. Notion has disabled the Insights feature and no longer serves open-weight models through Fireworks.

Key facts

1. Intrusion path: On October 23 a third-party cloud provider was compromised; on October 24 attackers entered Fireworks development systems and ran an unauthorized workload.
2. Exposed data in three categories: Resource metadata; billing information, including billing and shipping addresses, invoice and payment histories, account balances and credit usage, with payment card numbers not stored and therefore unaffected; and, for certain customers, a subset of incomplete model weights and datasets.
3. Notion's affected scope: Under 1% of workspaces; the exposed transcripts did not contain tool call results, and beyond the conversation itself no information ties them to a specific workspace, user or company; no other Notion features were affected.
4. Other customers: The Register, citing Bloomberg, reported that Fireworks is also working with customers including Cursor and Harvey to assess the impact.
5. Response: Fireworks worked with Palo Alto Networks' Unit 42 team on remediation, rotating credentials, isolating affected systems from the network and tightening data storage access and monitoring.
6. Number of customers affected: Fireworks did not state how many customers were affected by either of the two October attacks.

Background

This is Fireworks' second intrusion in a month. The company first disclosed an incident on October 9, after detecting unauthorized use of internal credentials on October 6, with environment variables in evaluation jobs accessed, including API keys and tokens belonging to some customers; at the time it said it had found no evidence of access to models, datasets, training data, inference traffic or personal information. The November 9 update substantially broadens the disclosed impact.