In its official help documentation, Notion disclosed that a security incident at its vendor Fireworks AI may have exposed some Notion AI chat sessions. Fewer than 1% of all workspaces may be affected, and according to Notion's English-language notice, in the vast majority of those workspaces the chats carried no labels identifying the speaker or the workspace they came from. Fireworks, for its part, said in an October 9 statement that its platform uses ZDR (zero data retention) and by default does not store prompts or generated output. So how could chat content leak from a service that is not supposed to store data? Setting the two companies' disclosures side by side suggests that the leak may have involved information stored as datasets, rather than ordinary inference processing.
What Notion's notice reveals, and what it doesn't
According to Notion's official help page, the company used Fireworks mainly for two purposes. One was data classification in "Insights," a feature that lets customers understand how they use AI. The other was an inference service that makes open-weight models available in Notion AI. In response to the incident, Notion disabled the Insights feature and stopped offering open-weight models through Fireworks.
Notion's English-language notice says it learned of the situation on the night of November 2. Fireworks reported that a malicious third party had accessed a small amount of data, but initially said it was limited to synthetic Notion AI test data and contained no customer data. As a precaution, Notion disconnected from Fireworks by November 3 and deleted all data held in Fireworks' systems. On November 6, however, it was told that the third party may also have accessed information that appeared to be customer data. Then, on November 8, Fireworks said it had identified a new dataset. When Notion analyzed it, it found that it contained chat records used in the Insights feature.
Notion says that in most of the affected workspaces, the records could not be used to identify the speaker or the workspace. It also says the records did not include tool-call results, and that nothing beyond the chat text could lead to the identification of a company or user. However, Notion has not disclosed the total number of chats that may have leaked, which specific Fireworks product it used for Insights classification, or which storage path the data was taken from. To think about the leak path, we need to keep these unknowns in mind and examine the incident details and data-retention mechanisms Fireworks has published.
Is "ZDR inference" at odds with "datasets were affected"?
In its initial findings, published October 9, Fireworks said it had confirmed that internal credentials were misused on October 6, and that environment variables from evaluation jobs run on a limited number of customer accounts had been obtained. It also said it had detected no evidence of unauthorized access, within its own control, to customers' models, datasets, training data, inference traffic, or personal information. In other words, at that point no damage to customer data itself had been confirmed.
The scope of the damage later expanded, however. According to Fireworks' updates, account and billing information was affected, and for some accounts secrets, datasets, and in-training models were also impacted. On October 23, an incident also occurred at a third-party cloud provider hosting Fireworks' research and development machines. The next day, a malicious third party reportedly used that access to break into the development machines and run unauthorized workloads, affecting additional customer data. The update page carries no publication date, but because it refers to a Google and Mandiant blog post published on November 2, it appears to have been written or updated after that date.
Fireworks' explanation of data retention matters here. Its data security documentation says that, when open models are used, prompts and generated data are neither logged nor stored unless the user explicitly opts in. That is the basic mechanism of ZDR. The same document also says that, in model training workflows, it may retain datasets, checkpoints, traces, trained models, and similar items. In other words, not every Fireworks feature is free of data storage; how data is handled depends on the purpose of the processing and the feature used.
Indeed, Fireworks' incident update page says ZDR applies by default to three products — the inference service, the Training SDK, and Nexus — and that no impact from this incident has been detected on them. It also says it has suspended uploads and downloads for self-service datasets used in Batch Inference and dataset-based training. This implies that, separate from the ordinary inference service, there are features that presuppose storing customer data.
Given that distinction, the accounts from Notion and Fireworks are reasonably consistent. Notion analyzed the new dataset that Fireworks notified it about and found chat records used in the Insights feature. Fireworks, meanwhile, acknowledges the impact on datasets while saying it has detected no impact on the ordinary inference service. Taken together, it is more consistent with what has been disclosed so far to think that the Notion AI chats did not leak directly from inference-time communications or logs, but from datasets that had been stored for some kind of processing.
Alternative possibilities, and what would overturn this reading
Still, important uncertainties remain in this reading. The biggest is that it is unclear what exactly the "new dataset" Notion mentioned refers to. It is impossible to tell from Notion's explanation alone whether it means a collection of input data that was stored in Fireworks' systems, or a set of data the attacker took out that was compiled in the course of the investigation. If it is the latter, the word "dataset" gives no basis for inferring where the data was originally stored, and the possibility that data was captured during inference processing remains.
Fireworks also said in its initial investigation that it had detected no evidence of unauthorized access to customer data, but later expanded the scope of damage. The update page says the investigation is ongoing and additional information may be published. Therefore, Fireworks' statement that it uses ZDR alone cannot fully rule out the leakage of data tied to inference processing. The data-retention policy as designed and what actually happened in the incident need to be considered separately.
Nevertheless, there are several pieces of circumstantial evidence for the view that the leak came from stored datasets. First, Fireworks itself acknowledges the impact on datasets while saying it has detected no impact on the inference service. Second, Notion says it analyzed the new dataset Fireworks notified it about and found records of chats used in the Insights feature. Third, Notion says that when it disconnected from Fireworks, it deleted the data in the company's systems and also stopped training processing. However, it is not clear exactly what data the deletion covered, and the halt of training processing cannot be treated as direct evidence of the leak's source.
All that can be said at this point is that it is relatively likely that information stored as datasets was involved in the leak. It has not been established when or for what purpose the Notion chats were stored on the Fireworks side, or whether they were stored there at all. If Fireworks' final investigation report or a Notion follow-up shows that the source was inference logs, this reading would be overturned. Conversely, if it is confirmed that Insights classification used features that involve data storage, such as Batch Inference, that would support the hypothesis that the data leaked from stored datasets.
What Notion AI users should do, and what to watch next
For organizations in Japan that use Notion AI for work, there are steps to take without waiting for the leak path to be clarified. Notion asks users to treat the affected data as leaked, and, if they entered passwords or API keys into Notion AI chats during the relevant period, to change or reissue them immediately. Owners of affected workspaces can check the relevant data by opening "Security incident review" from the "?" in the sidebar. This review feature must be used from the desktop app or a web browser and is not available in the mobile app.
Going forward, there are two points to watch: whether Fireworks identifies the product or feature that was the source of the leak, and whether Notion clarifies the data path it used for Insights classification. The case highlights that even when an AI service says it does not store data in ordinary inference processing, that alone does not let you judge the safety of every related data-processing and storage path. The lessons from this incident will differ greatly depending on whether the leak occurred in a feature involving storage or on a path tied to inference processing. In their future explanations, both companies will be expected to clarify not only the scope of the damage, but also how the chat data was handled and through which path a third party gained access to it.