Notion revokes API keys found in AI chats affected by Fireworks breach

Notion said it revoked Notion API keys on November 11 after finding them in user messages affected by a security incident at its AI supplier, Fireworks AI. In a separate notice that day, Japanese information security company LRM said it found the names of business partners’ staff in records of its own Notion AI chats that may have been exposed. LRM is still investigating whether a third party obtained the records and how much it may have accessed.

Notion puts the scope at less than 1% of its workspaces, the spaces teams use to share their work. The company says it has contacted customers it has identified as affected. Owners of those workspaces can check which members were affected and send them a link to review their own records. Notion says it will contact more customers directly if the investigation identifies additional workspaces.

The chats were used to produce AI usage statistics

Fireworks first notified Notion on November 2. Notion initially identified synthetic test data. By November 3, it had disconnected Fireworks and deleted its data from the vendor’s systems. Fireworks raised the possibility of customer data exposure on November 6 and confirmed the dataset in scope on November 8. Notion says it found real customer chat transcripts in that dataset and began contacting affected customers on November 9.

The transcripts were used for Insights, a workspace feature that showed administrators how their teams used AI, including conversation counts and categories of work. Notion sent stored messages and replies to Fireworks for classification to produce that view. Notion has suspended Insights during its investigation. Its settings guide now says the tab is paused and those counts and categories are unavailable.

Fireworks says its default policy is to hold the contents of ordinary real-time requests in memory only while processing them. Its policy separately describes features that can involve storage, including batch processing and model training. Notion says its own retention commitments for response generation do not cover stored chat history and Insights. It says Fireworks had agreed by contract to retain no data from Notion’s use of the platform, and the investigation found data had been retained.

The text itself could identify people

LRM says it heard from Notion on November 10. Its review concerns some of its own chats created from October 5 through October 24 and used to process Insights. The records contained text written by staff and replies generated by Notion AI. LRM found business contacts’ names in the text and said it found no credentials such as system passwords in the records it reviewed.

Notion says that, for most affected workspaces, the chats lacked separate labels naming the author or the workspace, and the transcripts did not include results from tools called by the AI. LRM found the names in the words typed into the chat. Notion says audio, transcripts and summaries from its AI Meeting Notes feature were outside the scope unless used as input in an affected AI chat.

What owners and members can review

Notion’s incident review is available in a desktop browser for affected workspace owners. Owners can download the list of affected members and give those members access to a CSV of their own data. A verified workspace domain is required for an owner to download the affected chat content for the whole workspace. Notion also offers an annotated file with added context to help owners review the text.

Notion’s developer documentation describes API keys as credentials for connected apps and automations. An integration that relies on a revoked key loses the ability to authenticate with it. Notion has advised affected customers to replace any other credentials they pasted into those chats. It gave no count for the keys it revoked.

Fireworks says it is notifying affected customers and has replaced credentials as part of its response to the October incident. LRM is still reviewing how many of its records were affected and what they contain. It says it will contact business partners whose information appeared in those records by email from its company domain and post further findings on its own site.