Notion has moved beyond warning customers about exposed AI conversations: it has revoked Notion API keys found inside affected messages and notified other vendors about their keys. The latest update to its Fireworks AI incident notice says those third-party notifications happened on November 12. For an affected team, the remaining job is to review what was actually pasted into the chats and replace exposed credentials; a vendor notification is not confirmation that every key has been disabled.
The incident affects fewer than 1% of Notion workspaces, according to the company. That is a workspace count, not a percentage of users. Notion says it has contacted affected customers; if a workspace has not heard from the company, it has not been identified as affected and no action is currently needed.
The first dataset looked like test data
The investigation changed after Notion had already cut the connection. On November 2, Fireworks told Notion that malicious actors had accessed a small dataset. Notion’s initial review found synthetic testing data, not customer conversations. Nevertheless, by the morning of November 3, Notion says it had disconnected from Fireworks, deleted its data in Fireworks’ systems and stopped communication between the two services.
That did not settle the scope of the earlier exposure. On November 6, Fireworks warned that customer data might also have been accessed. A second investigation followed, and Fireworks confirmed the affected dataset on November 8. Notion contacted impacted customers on November 9.
The dataset included Notion AI chat transcripts used for Insights, a feature for understanding AI usage. Notion had used Fireworks for classification work supporting Insights and as an inference provider for open-weight models. It has disabled Insights and stopped serving those models through Fireworks. The company’s advisory says no other Notion features were affected.
No author label does not make a key harmless
For the vast majority of impacted workspaces, Notion describes the transcripts as unattributable: they were not labelled with the writer or workspace, and they contained no tool-call results. That limits what the surrounding records disclose. It does not remove information someone typed into the conversation itself.
An API key is a credential that software can present to a service. If a usable key appears in a message, removing the author’s name does not revoke its permissions. This is the important turn in the incident: a conversation can carry access authority, not just private prose. The separate AgentCore memory experiment showed another route by which a working credential can leave an AI system; that laboratory test is distinct from this vendor incident.
On November 11, Notion revoked the exposed Notion API keys it found in affected messages. Its latest update says that on November 12 it reported exposed third-party API keys to the vendors that issued them. Those are two different responses. The notice does not establish that every third-party credential has been revoked, nor does it report a total key count or demonstrate misuse of those keys.
Review the transcript, then replace the exposed secret
Notion says affected customers can securely retrieve and review the impacted data inside their workspace, following the instructions it sent them. That gives administrators a concrete starting point: check the actual conversations for passwords, API keys and other credentials, rather than assume every workspace secret was involved.
For credentials present in the affected data, replace or rotate them at the service that issued them, update the applications that use them and ensure the old value is no longer valid. Notion recommends rotating credentials pasted into Notion AI during the incident timeframe. Where the issuing service provides access logs, review activity associated with the exposed credential. A transcript without an account label is still evidence worth checking.
The broader lesson is about retained working material. In the investigation of exposed Cairn panels, project notes could disclose secrets even when a task failed. Here, the location was a vendor-held conversation dataset. Disconnecting a provider stops future traffic; replacing a copied credential addresses the access it may still grant.
References
- Notion. Fireworks AI incident. Original disclosure November 9, 2026; updates November 11 and 13, 2026. Accessed November 13, 2026.
