Notion AI Chats Exposed in Partner Data Breach

AI provider Fireworks AI has confirmed a wider data breach, which also exposed some user data from its customer, Notion.

AI infrastructure firm Fireworks AI has confirmed that a data breach it experienced in October was significantly more extensive than first revealed. According to reports, the attackers gained access to a wide range of sensitive information, including customer account details, billing information, and internal company secrets. The breach also exposed partial datasets and incomplete machine learning model weights, which are crucial components of the company's AI services. The incident's impact extended to one of Fireworks AI's prominent customers, the productivity platform Notion. While Notion stated that the breach affected "fewer than 1% of Notion workspaces," the event highlights the cascading risks present in modern software supply chains. The compromised data included logs of some conversations users had with Notion's AI features, which are powered by Fireworks AI's infrastructure, demonstrating how a vulnerability in a single vendor can expose end-user data from another application entirely.

This incident is a classic example of a supply chain attack, a type of security threat that has become increasingly common in the interconnected world of cloud services. Instead of targeting a large, well-defended company like Notion directly, attackers focus on a smaller, potentially less secure third-party vendor within its technology stack. In this case, Fireworks AI provides the underlying infrastructure that powers some of Notion’s AI capabilities. By compromising Fireworks AI, the attackers found a backdoor to access data related to its clients. The exposure of secrets, such as API keys or access tokens, is particularly dangerous. These credentials could allow attackers to move laterally across systems, escalate their privileges, and potentially access even more data. The theft of incomplete model weights is also notable; while not a complete model, this proprietary data represents significant intellectual property and could be analyzed by competitors or malicious actors to understand the model's architecture.

The Fireworks AI breach fits into a broader, worrying trend where the rapid adoption of artificial intelligence is creating new and complex security challenges. As companies rush to integrate generative AI features into their products, they often rely on a growing ecosystem of specialized third-party providers for model hosting, fine-tuning, and inference. This dependency creates a sprawling and often opaque supply chain, where each new vendor introduces a potential point of failure. This situation mirrors earlier security crises in the software world, such as the SolarWinds attack, which showed how compromising a single software provider could lead to widespread infiltration of government and corporate networks. The AI industry is now facing its own version of this problem. The immense value of the data being processed by AI systems—from proprietary code and financial data to private user conversations—makes AI infrastructure providers a high-value target for cybercriminals.

For founders, CTOs, and security leaders, this event serves as a critical lesson in third-party risk management for the AI era. Simply vetting a vendor with a standard security questionnaire is no longer sufficient. Organizations must demand greater transparency from their AI partners regarding their security architecture, data isolation practices, and incident response capabilities. It's crucial to ask pointed questions: How is our data segregated from other customers? What access controls are in place for your employees? What is your protocol if a breach occurs? The key takeaway is that a company’s security posture is only as strong as its weakest link, and in the age of AI, that link is often a third-party service provider. Going forward, we can expect to see increased pressure on AI infrastructure companies to adopt more rigorous security standards and undergo independent audits. In the meantime, businesses should be proactively reviewing their own AI dependencies and creating contingency plans for potential vendor-related security incidents.

This incident is a critical reminder of AI supply chain vulnerabilities. When a core infrastructure provider is compromised, it can expose sensitive customer data from multiple downstream applications, including secrets, model weights, and private user conversations, even for major platforms like Notion.

The breach forces companies to re-evaluate their AI vendor security and third-party risk management. The reputational damage to both Fireworks AI and Notion, even with limited impact, underscores the high cost of a single weak link in the AI technology stack.