Notion discloses chat transcript exposure through Fireworks Notion discloses chat transcript exposure through Fireworks

The assessment changed after a second dataset

Notion initially received a November 2 warning involving synthetic testing data. It disconnected from Fireworks by November 3. A November 6 notification prompted another investigation, and Fireworks confirmed the additional dataset on November 8. Notion says affected customers have been contacted. For most impacted workspaces, transcripts lacked user or workspace labels and excluded tool-call results. That separation matters, although the conversation itself remains part of the exposed material. The response therefore gives notified customers a way to inspect their own data, instead of asking them to infer exposure from a platform-wide announcement.

Development systems and production services differ

Fireworks describes an October 23 incident at a third-party cloud provider followed by access to development machines on October 24. Its updated bulletin lists account and billing information, plus some customers’ datasets and incomplete model weights. Payment-card numbers were excluded. The company disabled self-service dataset uploads and downloads for Batch Inference and dataset-based training. Training SDK remains available. These are distinct operational paths: a stored dataset, a development machine and a live inference request do not have identical retention or access boundaries. A supplier’s product name alone cannot describe which path a customer’s material took.

The wider risk includes stolen compute

A separate November 2 report from Google Threat Intelligence Group and Mandiant describes criminals reselling unauthorized model access through illicit routing services. Mandiant observed individual incidents with more than $100,000 in fraudulent daily charges and some cumulative bills reaching $1 million. Those figures describe its wider investigations, not losses established in the Notion incident. The researchers identify stolen cloud identities and model credentials as recurring entry points. They also describe attackers enabling model services that victims were not previously using. This makes resource theft different from a familiar stolen-document incident: the attacker can create a new running bill while the original application continues to function.

A response has two separate jobs

Mandiant’s defensive guidance separates access control from spending control. It recommends narrowly scoped credentials, monitoring for unauthorized service changes, model quotas and budget limits. Those measures address continued use of a stolen credential; they do not retrieve a conversation that has already left a system. Conversely, removing account labels does not revoke a password pasted into a conversation. For a software team, exposure review and credential containment are separate workstreams. The distinction also explains why a small affected-workspace percentage cannot decide the severity for any individual customer: the contents of that customer’s transcript determine the next action.