Hackers stole AI conversations through Fireworks: Notion says fewer than 1% of workspaces may be affected

A user pastes an excerpt from a contract into an AI chat and asks it to explain a disputed clause. From their perspective, everything happens inside a single application. Behind the scenes, the request may go to a model provider, and the conversation may enter a separate analytics system. The Fireworks AI breach shows why developers and product managers need to understand that entire path: a contractor’s data breach becomes a problem for your product and your customers.

According to TechCrunch, attackers gained access to Fireworks’ development system through its cloud provider. The company confirmed access to some customer data, including payment information and certain datasets. Notion was among the customers confirmed to be affected. This raises a concrete, practical question: what copies of a user’s conversation are created after they click “Send,” and who can access them?

What the conversations contained

Notion’s official notice says the incident may have affected fewer than 1% of workspaces. This is an important qualification to the initial report: the share of workspaces is not the same as the share of users. The dataset discovered contained Notion AI conversations used for the Insights feature.

Notion says that, for most affected workspaces, the chats did not include information identifying their author or workspace. Tool call results were not included in these records. The content of the conversation itself still matters, however: the absence of a separate company-name field does not make the text safe.

Consider a typical request: “Draft a reply to the client about this contract.” The user then pastes the company name, the amount and the terms of the deal. Even without a label attached to the record, that text could reveal commercial information. This is an example of a potential risk, not a description of confirmed content in the stolen chats.

How a contractor expands a product’s boundaries

According to Notion, Fireworks was used for classification in Insights and to serve open models. By the morning of November 3, Notion had disconnected the integration and deleted data from the contractor’s system. The investigation later identified a dataset containing customer conversations. Insights has been suspended, and open models are no longer served through Fireworks.

For a team building an AI product, it helps to distinguish several operations here. The model receives a request to generate a response. Analytics may subsequently process the conversation to assess service usage. Debugging systems may retain individual examples to investigate errors. Each operation requires its own answers about access, retention periods and deletion.

The published account does not provide enough information to reconstruct all the technical circumstances of the breach. It would therefore be premature to attribute it to a particular retention policy or access setting. But teams can review their own settings now: map data transfers, locate stored copies of requests and assign an owner to each integration.

A useful engineering test is to take one fictional conversation and trace its path through the application, model provider, error logs and analytics. Where is the full text retained? Where would an anonymized event or a counter suffice? Can the conversation be deleted from all these locations? The answers offer far more than a general promise to protect data.

What customers and founders should do

Notion recommends that affected customers treat the data as exposed and review the incident materials available to them. Any passwords, API keys or other credentials included in the relevant conversations should be replaced. The company says it is notifying identified affected customers directly; the investigation is ongoing.

Founders should check who on their team can quickly disconnect a provider and which features would stop working as a result. Product managers should make sure their explanation of data processing covers analytics and supporting features. Developers should reduce full-text retention wherever metadata is sufficient for the task. Responsibility to users starts with understanding how many systems receive their conversations and why each needs a copy.