Fireworks AI, an inference vendor, now reports two incidents in a month, the second reached billing data, secrets, datasets and some model weights. Notion says some of its AI chat transcripts were in the data. We build one timeline and list what customers can check.
This explains reporting by
Fireworks AI: Update on October 2026 security incident (last updated November 9, 2026). Read the original first:
https://fireworks.ai/security/bulletins/october-2026-security-incident-update
In one minute #
- Fireworks AI found unauthorized access on October 6 and told customers on October 9 that API keys stored as secrets in some evaluation jobs were likely captured.
- On October 23 a third-party cloud provider that hosted Fireworks R&D machines had its own incident. On October 24 the attacker used it to reach Fireworks development machines. Fireworks detected it the same day.
- The November 9 update adds billing data, and for some accounts secrets, datasets and incomplete model weights. Fireworks says Inference, Training SDK and Nexus, which keep no data by default, were not touched.
- Notion says unattributable Notion AI chat transcripts were in the data, affecting fewer than 1% of workspaces, and tells people to treat them as exposed and rotate any credential ever pasted into Notion AI.
Two incidents, one month #
Fireworks sells hosted inference and training for open-weight models. Customers send prompts, upload datasets and, for some jobs, store API keys for other services as secrets inside Fireworks.
The first incident, per Fireworks' October bulletin: an unauthorized party used internal Fireworks credentials to reach environment variables used in evaluation jobs for a limited number of accounts. Fireworks says API keys and tokens stored as secrets were 'likely captured'. It started notifying customers on October 7, rotated employee keys on October 9 and revoked more user keys on October 10.
The second, per the November 9 update: 'A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23. On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact.' Fireworks does not name the provider. BleepingComputer adds that Fireworks brought in Palo Alto Networks' Unit 42.
What was taken #
Fireworks lists resource metadata, billing details (addresses, invoice and payment history, account balance and credit usage) and, for certain customers, 'a subset of incomplete model weights and datasets'. It says payment card numbers are not stored and were not affected.
Fireworks says it has 'not detected any impact to Inference, Training SDK and Nexus, which are all zero data retention (ZDR) by default'. That is a statement about the serving path. Datasets a customer uploads for batch jobs or training are a different store, and the update says some datasets were accessed. Fireworks has d self-serve dataset upload and download for batch inference and dataset-based training while it investigates.
Fireworks ties the activity to a financially motivated group that sells access to AI models, a crime often called LLMjacking: steal API keys, then resell or burn the compute they unlock.
How Notion's AI chats were caught up #
Notion's page says it used Fireworks for its Insights feature and as an inference provider for open-weight models. It disconnected from Fireworks and deleted its data there on November 3, heard on November 6 that 'malicious actors may have accessed potential customer data', and had the new dataset confirmed on November 8.
The data was 'unattributable' Notion AI chat transcripts: no author or workspace label and no tool call results. Notion says fewer than 1% of workspaces may be affected, and recommends: 'treat this data as if it were exposed.' Workspace owners can review the affected data in a desktop browser through the help menu under 'Security incident review'.
Unattributable does not mean harmless. A transcript with no name on it can still hold a pasted password, an API key or a customer's details. That is why Notion's advice is to rotate anything credential-like that was ever pasted into Notion AI.
Why deleting a secret is not enough #
Fireworks' October bulletin says removing a stored secret does not invalidate it. A key is a string. Once copied, it works anywhere until the service that issued it revokes it. So the fix is at the issuer: rotate the key with OpenAI, Anthropic, AWS or whoever made it, then check that provider's usage logs for calls you did not make.
What to check #
- If you use Fireworks: look for an affected-customer notice. Fireworks says customers who were not notified were not identified as affected so far.
- Rotate every third-party key you ever stored as a Fireworks secret, at the issuer, then review that provider's usage for odd calls.
- Check your Fireworks account for API keys, users, evaluators, jobs and datasets you do not recognize, as Fireworks' bulletin lists.
- If you use Notion AI: open the Security incident review page and rotate anything credential-like your team pasted into AI chats.
- If you are an MSP: ask clients which AI vendors hold their data or keys. Many will not know that a note-taking tool sent chat text to an inference vendor.
Who is affected #
| Case | Status |
|---|---|
| Fireworks accounts named in a notice | Billing data; for some, secrets, datasets and incomplete model weights. |
| Fireworks Inference, Training SDK, Nexus | No impact detected, per Fireworks (zero data retention by default). |
| Notion workspaces | Fewer than 1% may have unattributable AI chat transcripts exposed, per Notion. |
| Payment card numbers | Not stored by Fireworks and not affected. |
What to do #
- Rotate any key stored as a Fireworks secret at the service that issued it.
- Review Fireworks for unknown keys, users, jobs and datasets.
- Check Notion's Security incident review page and rotate pasted credentials.
What is still unknown #
- Fireworks gives no customer count and does not name the cloud provider.
- How Notion's transcripts reached the stolen store is not stated by either company; comment-thread guesses about batch uploads are unconfirmed.
- Whether the stolen data has been sold or used is not stated.
- A comment on Hacker News says a customer's Anthropic keys stored in Fireworks were abused after a 'not impacted' notice; that is unverified.
Sources #
- [Fireworks AI: Update on October 2026 security incident (last updated November 9, 2026)](https://fireworks.ai/security/bulletins/october-2026-security-incident-update) — the original report
- [Fireworks AI: October 2026 security incident bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident)
- [Notion: Security incident involving a third-party AI vendor](https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor)
AI News Report· every headline, every morning.