What happened
Notion’s security advisory, updated November 12 and 13, 2026, describes its side of an incident involving Fireworks AI, which Notion used both for classification jobs supporting its Insights feature and as an inference provider for open-weight models in its product. The advisory says the incident is affecting fewer than 1% of Notion workspaces. Notion says it has contacted affected customers and that customers who have not heard from the company have not been identified as affected; its investigation remains ongoing.
On the evening of November 2, Fireworks told Notion that malicious actors had accessed a small set of data. Notion’s initial investigation found Notion AI synthetic testing data, and the company says no customer data was involved in that dataset. Notion disconnected its systems from Fireworks by the morning of November 3 and deleted its data stored in Fireworks’ system on November 4. On November 6, Fireworks informed Notion that potential customer data might also have been accessed. Notion opened another internal investigation, and Fireworks confirmed the final impacted dataset on November 8.
Notion says its analysis of that dataset found AI chat transcripts used for the Insights feature. In most affected workspaces, those transcripts were “unattributable”: they were not labeled with the author or workspace, and did not include tool-call results. Notion says the transcript itself contained no further information tying it back to a workspace, user or company. The advisory says no other Notion features were affected. It does not give the number of workspaces or transcripts involved.
Notion says it reached out to affected customers on November 9. The company has disabled Insights while it investigates and no longer serves open-weight models through Fireworks. It also describes credential-related steps taken during the investigation: on November 11, it revoked exposed Notion API keys found in affected user messages; on November 12, it reported exposed third-party API keys found in those messages to the vendors that issued them. Notion recommends that affected customers treat the data as exposed, review it through secure instructions sent by email, and rotate passwords, API keys or other credentials pasted into Notion AI during the incident timeframe.
What the archive adds
New Runtime’s earlier coverage reported that Fireworks’ October cloud-provider breach also affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models (November 10, 2026 note). On November 13, New Runtime covered the first disclosure that the breach reached Notion AI Insights transcripts (earlier note). This is a further update to a known incident, adding Notion’s account of transcript attribution, response actions and customer guidance.
Trend signal
This does not yet fit a pattern New Runtime tracks. The advisory describes a third-party provider incident and customer-data response, but it does not establish a broader shift in how agent runtimes constrain access, memory, execution or authorization.
Why now
The advisory’s November 12 and 13 updates reflect Notion’s continued investigation after Fireworks confirmed the final impacted dataset on November 8. The later updates add actions taken on November 11 and 12 after exposed API keys were found in affected messages, making credential rotation and vendor notification part of the incident response.
Connections to other events
The incident connects the Notion disclosure to Fireworks’ earlier account of its October cloud-provider breach. New Runtime’s November 10 coverage said Fireworks had disclosed effects on account and billing information, and, for a limited set of accounts, secrets, datasets and incomplete models. Notion’s advisory identifies another downstream customer-data impact: transcripts generated through an AI product that used Fireworks for classification and inference.
Why it matters
Teams integrating hosted model infrastructure should treat a provider’s incident scope as something that can change as investigations progress. Notion’s first identified dataset contained synthetic testing data, but later information from Fireworks led it to investigate potential customer data and ultimately identify Insights transcripts. The distinction matters operationally: an initial “no customer data” finding may describe one dataset or investigative stage rather than the final impact.
The credential details also show why data minimization and incident procedures need to cover user messages, not only formal secrets stores. Notion found API keys in affected messages, revoked its own keys and notified the vendors responsible for third-party keys. For builders, a practical response plan should specify how to identify exposed credentials, who can revoke them, how affected users are notified, and how the scope is updated when a vendor revises its findings. Notion’s account does not establish that other customers or providers face the same exposure, but it makes these response steps concrete.
Limits and uncertainty
Notion says its investigation is ongoing and that it will update the advisory as it learns more. It has not quantified the affected workspaces or transcripts beyond saying the impact is under 1% of workspaces. The advisory does not say how many messages contained credentials, whether any exposed keys were used by attackers, or what data the attackers did with the transcripts. Notion describes most transcripts as unattributable, but does not quantify the share that could be attributed. The account is Notion’s description of the incident; the advisory does not independently establish the full scope of Fireworks’ breach.
Reader takeaway
A third-party AI provider can extend the path by which user content and credentials are exposed. Notion’s response evolved as the confirmed dataset changed: it isolated the provider, disabled affected features, revoked its own keys and directed customers to rotate secrets. Teams should be ready to reassess scope and act on credentials as an investigation develops.