By the Smili Phone team
On November 11, 2026, Notion told its customers something that sounds strange at first: some Notion AI chat transcripts were exposed in a breach, but Notion itself was never hacked. The break-in happened at Fireworks AI, a vendor that runs models for Notion. Your chats went to a company you never signed up with, and that company got breached.
Notion says fewer than one percent of its workspaces are affected. The exposed material is Notion AI chat transcripts from a dataset used for Insights, a feature that shows workspace administrators how their teams use Notion AI. Notion has switched Insights off while its investigation continues, and documents, pages, and passwords stored in your workspace were not part of the exposure.
What actually leaked
The transcripts are the words people typed into Notion AI. For most affected workspaces, Notion says the chats were unattributable, meaning they carried no label for who wrote them or where they came from, and they did not include results from tool calls. A message with a customer list, a contract paragraph, or an API key carries that content with or without a name attached.
Notion tells affected customers to act as if the data was exposed. On November 11, Notion revoked API keys found inside affected messages. Its advice is simple: rotate any password, API key, or other credential you pasted into a Notion AI chat. Workspace owners can review the exposed data through Security incident review in Notion's web interface.
How it happened
Fireworks says a third-party cloud provider that hosted its research and development machines had a security incident on October 23, and attackers used it to reach Fireworks development machines the next day. It was a second incident. Fireworks had already found unauthorized use of internal credentials on October 6, which touched stored secrets for some accounts.
Fireworks warned Notion on November 2 about a dataset that looked exposed. By the morning of November 3, Notion had cut Fireworks off, deleted all of its data there, and paused training runs. On November 6, Fireworks said customer data may have been accessed, and on November 8 it confirmed it, including Notion user data. Notion began contacting affected customers on November 9.
Fireworks links the attack to a financially motivated group that sells unauthorized access to large language models, a practice known as LLMjacking. It brought in Palo Alto Networks Unit 42 to help with the investigation.
The lesson for everyone else
This breach is a reminder that your words travel further than the app you typed them into. Notion had a zero retention contract with Fireworks, meaning the vendor was supposed to keep none of the data, yet transcripts still ended up in a dataset attackers could reach.
The practical rule is the same one we give for every AI tool on your phone or computer. Never paste a password, an API key, a recovery code, or anything you would not want read aloud into an AI chat. If you already did, rotate it now and do not wait for a breach notice. If you use Notion, check whether your workspace was affected.
Most people will not need to do anything. But the habit matters more than this one incident. Your AI chats are data, and data lives in more places than you think. If your phone needs attention, a battery that drains too fast or a screen that stopped responding, bring it by our shop in Escondido and we will take a look together.
Related: Claude Code Leaks Passwords With One Click · Your Phone's Hidden Security Mode: Turn It On
