Notion users put access keys in AI chats. A supplier breach exposed them

These keys allow software to access workspace data within the permissions their owners granted. Most impacted workspaces had chats without ownership labels, but message text could still contain identifying information or credentials.

Limited Impact

Notion states the incident affected fewer than 1% of its workspaces. The exposed dataset included Notion AI chat transcripts used for its Insights feature. For the vast majority of affected workspaces, those transcripts lacked labels identifying who wrote the chats or which workspace they belonged to.

The API keys found in affected messages demonstrate why missing ownership labels still leave secrets in the text, even when tool-call results weren't present.

Timeline of Events

Notion initially disconnected from Fireworks on November 3 after receiving a notification that appeared to involve synthetic testing data only. Fireworks then notified Notion of potential customer-data access on November 6 and confirmed the new dataset on November 8.

Notion identified the Insights transcripts in that material and disabled Insights during its investigation. It also stopped serving open-weight models through Fireworks, though no other Notion features were affected.

Customer Response

Notion urges affected customers to rotate pasted credentials beyond just the revoked keys. The company recommends reviewing impacted data securely inside workspaces, treating that material as exposed, and rotating passwords, API keys or other credentials pasted into Notion AI during the incident timeframe.