Notion disabled exposed API keys on Nov. 11 after finding them in AI chats caught up in a breach at its supplier Fireworks AI, according to the company’s updated security advisory, as relayed by CryptoSlate. Notion says the incident affected fewer than 1% of its workspaces.
The advisory does not report any misuse of the Notion keys covered by the revocation. Notion’s account has not been independently verified, and it is the only source for most details below.
What was exposed
According to Notion, the exposed dataset included Notion AI chat transcripts used for its Insights feature. For most affected workspaces, the transcripts lacked labels identifying the author or the workspace and contained no tool-call results.
Notion says the content of the messages could still link a conversation to a user, a workspace or a company. That is how API keys pasted into chats can remain a risk even without ownership labels.
How the incident unfolded
Notion says it received a first notification from Fireworks on Nov. 2 that appeared to involve synthetic testing data only. By the morning of Nov. 3, it had disconnected its systems from Fireworks, deleted data held in the Fireworks system and stopped communications.
On Nov. 6, Fireworks notified Notion of potential customer-data access. Fireworks confirmed the new dataset on Nov. 8, and Notion identified the Insights transcripts in it. In a Nov. 9 incident update, Fireworks described impacts to resource metadata, billing information, secrets, datasets and incomplete model weights for a limited set of accounts.
Notion’s response and advice
Notion said it disabled Insights during its investigation and stopped serving open-weight models through Fireworks. It says no other Notion features were affected.
The company recommends that affected customers review the impacted data, treat it as exposed, and rotate passwords, API keys or other credentials pasted into Notion AI during the incident timeframe. It says it has contacted the customers it identified as affected.
Fireworks, as relayed by CryptoSlate, says it has detected no impact to Inference, Training SDK or Nexus, which have zero data retention by default. It describes these findings as provisional while its investigation continues.
What remains unknown
Several points are unclear. These include the exact number of affected workspaces beyond the ‘fewer than 1%’ figure, how the Fireworks AI breach occurred and who is responsible. It is also not known how many API keys were exposed, whether any credentials other than the revoked Notion keys were misused, or whether and when Insights will return.
Sources
- cryptoslate.com CryptoSlate — Notion users put access keys in AI chats. A supplier breach exposed them Accessed
Comments