Notion revokes API keys after supplier Fireworks AI breach exposed credentials
Notion disabled API keys found in AI chat transcripts after a breach at supplier Fireworks AI, affecting fewer than 1% of workspaces and urging customers to rotate credentials.
Mark NovakCybersecurity researcher · via COINMAG
Key takeaways
- Notion revoked exposed API keys on November 11, 2026 after discovering them in AI chat transcripts.
- The incident impacted fewer than 1% of Notion workspaces, according to the company's security advisory.
- Notion advised affected customers to rotate any passwords, API keys or other credentials pasted into Notion AI.
Notion disclosed that API keys embedded in AI chat transcripts were exposed following a breach at its third‑party provider Fireworks AI. The company disabled the compromised keys on November 11, 2026 and warned customers to replace any other credentials that may have been pasted into Notion’s AI interface.
Breach timeline and data exposure
According to CryptoSlate, Fireworks AI first notified Notion of a possible data leak on November 6, confirming the compromised dataset on November 8. Notion had already disconnected from Fireworks on November 2, deleted data held in the supplier’s system and halted communications by the morning of November 3. The exposed data consisted of Notion AI chat transcripts used for the Insights feature, most of which lacked ownership labels but could still contain identifying information.
Scope of the impact
Notion estimates that fewer than 1% of its workspaces were affected. While the advisory does not record any misuse of the revoked keys, it notes that the keys could have allowed full access to workspace content within the permissions granted to the token holder.
Response and recommendations
The company has disabled the Insights feature during its investigation and stopped serving open‑weight models through Fireworks. Notion’s guidance to affected customers includes reviewing the exposed chat material, treating it as public, and rotating any passwords, API keys, or other credentials that were entered into Notion AI during the incident window.
What to watch next
Future updates from Notion and Fireworks AI will clarify whether any of the exposed keys were actually used and whether additional workspaces become identified as compromised. Observers will also monitor any regulatory scrutiny of third‑party AI integrations that handle sensitive credential data.
FAQ
What data was exposed in the Notion breach?
AI chat transcripts used for Notion’s Insights feature were exposed, and some contained API keys and other credentials.
When did Notion revoke the compromised API keys?
The compromised API keys were revoked on November 11, 2026.
How many Notion workspaces were affected?
Notion estimates that fewer than 1% of its workspaces were impacted by the breach.
Mark NovakMark Novak is a cybersecurity researcher. He writes about wallet security, hacks, exploits, scams and digital risks, and explains what each incident means for users and how to stay safe.All articles by the author
Discussion 0