---
type: "post"
id: "cyberattack-on-fireworks-ai-allowed-hackers-to-access-7624d4"
slug: "cyberattack-on-fireworks-ai-allowed-hackers-to-access-7624d4"
title: "Cyberattack on Fireworks AI allowed hackers to access Notion customers' chat transcripts"
description: "A breach at Fireworks AI exposed chat transcripts belonging to some Notion AI users of its Insights feature."
retrieval_nugget: "A breach at Fireworks AI exposed chat transcripts belonging to some Notion AI users of its Insights feature. Notion says about 1% of its customers were affected. For teams building with AI, the incident shows how sensitive prompts and responses can cross a company’s security boundary through an infrastructure provider."
published_at: "2026-11-13"
updated_at: "2026-11-13"
record_date: "2026-11-13"
date_kind: "published_at"
topics: ["ai-security","security"]
entities: ["Fireworks AI","Notion","Notion AI","Insights"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "The breach’s impact now includes stolen Notion AI Insights chat transcripts, affecting around 1% of Notion customers."
prior_refs: ["https://newruntime.com/posts/update-on-october-2026-security-incident-c8af72/"]
source_url: "https://techcrunch.com/2026/11/12/cyberattack-on-fireworks-ai-allowed-hackers-to-access-notion-customers-chat-transcripts"
source_urls: ["https://techcrunch.com/2026/11/12/cyberattack-on-fireworks-ai-allowed-hackers-to-access-notion-customers-chat-transcripts"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:cyberattack-on-fireworks-ai-allowed-hackers-to-access-7624d4"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/cyberattack-on-fireworks-ai-allowed-hackers-to-access-7624d4/","markdown":"https://newruntime.com/posts/cyberattack-on-fireworks-ai-allowed-hackers-to-access-7624d4.md","json":"https://newruntime.com/posts/cyberattack-on-fireworks-ai-allowed-hackers-to-access-7624d4.json"}
markdown_url: "https://newruntime.com/posts/cyberattack-on-fireworks-ai-allowed-hackers-to-access-7624d4.md"
---

# Cyberattack on Fireworks AI allowed hackers to access Notion customers' chat transcripts

## Retrieval answer

A breach at Fireworks AI exposed chat transcripts belonging to some Notion AI users of its Insights feature. Notion says about 1% of its customers were affected. For teams building with AI, the incident shows how sensitive prompts and responses can cross a company’s security boundary through an infrastructure provider.

## Summary
A breach at Fireworks AI exposed chat transcripts belonging to some Notion AI users of its Insights feature. Notion says about 1% of its customers were affected. For teams building with AI, the incident shows how sensitive prompts and responses can cross a company’s security boundary through an infrastructure provider.

## What happened
TechCrunch reports that Fireworks AI, a platform developers use to access open AI models, confirmed an attacker breached its cloud provider and gained access to a Fireworks development system. That access exposed data belonging to some Fireworks customers. The company said the attackers took customer billing information and some datasets. Fireworks serves tens of thousands of customers worldwide, TechCrunch reports.

Notion was among the affected customers. Notion said Fireworks alerted it to a security incident and later confirmed that hackers had stolen some Notion customer data. Notion’s disclosure put the impact at around 1% of its customers. The data specifically included chat transcripts from Notion AI customers who had used the Insights feature.

Notion said those transcripts include any input to or output from the model that was written to the chat. It also said much of the data was unattributable, so it could not determine which customer it came from. On November 3, Notion disconnected its systems from Fireworks, deleted data stored in its systems, and stopped all connectivity between the two. The report says Notion confirmed the transcript theft this week, on November 12.

Fireworks said it believes the attackers were financially motivated and focused on selling tokens obtained through unauthorized access to large language models. In this kind of scheme, unauthorized third parties can use model capacity without paying for it themselves. TechCrunch describes this as the second breach affecting Fireworks in as many months, following an October security incident. The report does not provide the number of individual transcripts exposed or identify the customers whose data could be attributed.

## What the archive adds
New Runtime's earlier coverage on [Fireworks AI’s October 2026 security incident](https://newruntime.com/posts/update-on-october-2026-security-incident-c8af72/) said the breach also affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. This is a new fact on a known story: the November report identifies Notion AI chat transcripts among the exposed data and gives Notion’s estimate of customer impact.

## Trend signal
This reinforces [agent security moving to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/): protecting an AI feature requires understanding what data its runtime and providers can access, not relying on the application’s own controls alone. The incident is not evidence of an agent runtime failure specifically, but it makes the vendor boundary and retained model interactions concrete parts of the security surface.

## Why now
The November 12 report adds details after Notion disconnected its systems from Fireworks on November 3. It comes roughly a month after the October incident at Fireworks, making the newly disclosed customer impact part of an unfolding security story rather than a new product change.

## Connections to other events
New Runtime's earlier coverage on [a shared Meta Muse chat exposed through passive DNS](https://newruntime.com/posts/ghostshares-a-shared-muse-chat-exposed-prep-for-167efa/) described a different route by which private AI conversations could become discoverable. Here, transcripts were exposed through a provider breach rather than share-link metadata. Both cases underline that conversation data can leave the user-visible application boundary in ways teams should map explicitly.

## Why it matters
AI features often send prompts and model responses through systems operated by vendors, even when users experience the feature as part of a familiar product. Those interactions can contain confidential material, and the Notion case shows that transcript data may be stored in a way that links some records to customers while leaving others unattributable. That complicates incident response: affected parties need to know not just whether a provider was breached, but what data crossed into its environment and whether it can be tied to a user.

For teams, the practical implication is to treat model providers and their infrastructure dependencies as part of the data perimeter. Before shipping an AI workflow, identify what is logged or retained, who can access it, what a disconnection actually deletes, and how quickly the integration can be cut off. Provider assurances and application-level privacy settings do not replace that inventory.

## Limits and uncertainty
The reporting does not establish how many individual Notion conversations or users were affected, beyond Notion’s estimate that around 1% of its customer base was impacted. It says much of the exposed transcript data could not be attributed to a customer. The attacker’s identity and the full scope of the Fireworks breach are not established in the report. Fireworks’ stated belief about financial motivation and token resale is not an independent finding about the attackers’ actions or buyers.

## Skill to build now
Map one AI workflow that handles sensitive information. Record which prompts, outputs and datasets are sent to each vendor, whether they are retained, and the steps needed to disconnect the integration and request deletion. Test the disconnection path rather than assuming that removing an API key erases previously stored data.

## Reader takeaway
A breach at an AI infrastructure provider reached Notion AI chat transcripts, not just conventional account records. If a feature sends user conversations to an external model platform, treat those conversations as data held across a vendor chain—and know how to identify, contain and delete them.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Ai Security](https://newruntime.com/topics/ai-security.md): Explore the ai-security topic hub.
- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)