Notion users put access keys in AI chats. A supplier breach exposed them

Notion disabled exposed API keys on Nov. 11 after finding them in AI chats affected by a breach at supplier Fireworks AI, according to its updated security advisory. These keys let software access workspace data within the permissions their owners granted.

Notion says the incident affected fewer than 1% of its workspaces. The exposed dataset included Notion AI chat transcripts used for its Insights feature.

For the vast majority of affected workspaces, those transcripts lacked labels identifying who wrote the chats or which workspace they belonged to, and contained no tool-call results. Information inside the messages could still connect a conversation to a user, workspace or company, however. The API keys found in affected messages show why missing ownership labels still leave secrets in the text.

Notion's API security guidance says someone holding a token can make requests within its capabilities and content permissions, potentially exposing or changing workspace content. An internal connection's access is limited to pages shared with it and its assigned capabilities.

The key revocations came after Notion's initial disconnection from Fireworks. After a Nov. 2 notification appeared to involve synthetic testing data only, Notion says it disconnected its systems, deleted data held in the Fireworks system and stopped communications by the morning of Nov. 3.

Fireworks then notified Notion of potential customer-data access on Nov. 6 and confirmed the new dataset on Nov. 8. Notion identified the Insights transcripts in that material.

Notion has disabled Insights during its investigation and stopped serving open-weight models through Fireworks. It says no other Notion features were affected. Its advisory does not report misuse of the Notion keys covered by the Nov. 11 revocation.

In its Nov. 9 incident update, Fireworks described impacts to resource metadata and billing information, as well as secrets, datasets and incomplete model weights for a limited set of accounts.

Fireworks separately says it has detected no impact to Inference, Training SDK or Nexus, services that have zero data retention by default. Those findings remain provisional while its investigation continues.

For affected Notion customers, the company's advice extends beyond the keys it revoked. It recommends reviewing the impacted data securely inside the workspace, treating that material as exposed and rotating passwords, API keys or other credentials pasted into Notion AI during the incident timeframe. Notion says it has contacted customers it identified as affected.