Third Party Provider Leak Exposes Notion AI Chat Transcripts

A massive oversight in cloud supply chain security has left enterprise workspaces scrambling to audit their third-party integrations. Fireworks AI, a popular cloud inference provider, recently suffered a critical security breach that compromised internal credentials and environment variables. During the chaotic fallout, detailed reporting from VentureBeat confirmed that attackers breached the Fireworks AI storage where Notion AI chats sat outside zero data retention parameters. This event highlights the hidden dangers of relying on external APIs for sensitive data processing.

Notion relies on external infrastructure to power specific backend utilities without bogging down their own servers. The company utilized Fireworks for classification jobs tied to a feature called "Insights," which analyzes how customers interact with their own workspace data. Unfortunately, this third-party integration became the exact entry point for threat actors.

While the productivity platform maintains strict privacy standards for its core databases, this specific secondary pipeline caught unattributable chat transcripts in the crossfire. The attackers managed to bypass the primary inference layer and access the raw storage buckets used for classification caching. Notion eventually confirmed that fewer than 1 percent of total workspaces were affected by the spill, but the reputational damage of a third-party leak remains a major headache for enterprise clients.

Tech companies heavily market the concept of Zero Data Retention to comfort privacy-conscious buyers. According to the official Notion AI security and privacy documentation, standard models process data only to generate a response and keep nothing afterward. But ZDR usually only applies to the core model inference layer.

When a vendor uses a Response API with storage enabled for secondary features like data classification or debugging, a temporary cache is automatically created on the provider's servers. Threat actors specifically target these hidden storage buckets because they bypass the main inference engine's strict deletion protocols. Even if the main AI model forgets your prompt instantly, the background classification script might hold onto it for days.

Following the initial compromise, Fireworks AI published an official security bulletin detailing the unauthorized access to their environment variables. The inference provider later issued a second update regarding the wider impact on customer datasets, billing information, and incomplete model weights.

Notion immediately disabled the Insights feature for the exposed cohort and rotated their API keys to sever the compromised connection. The productivity giant also stressed that the exposed chats were unattributable, meaning they could not be easily linked back to specific user accounts without access to Notion's internal mapping databases.

This incident proves a hard lesson for IT administrators. Your data privacy policy is only as strong as the weakest third-party tool sitting in your backend tech stack. When evaluating AI vendors, teams must look past the marketing jargon and audit exactly where secondary API caches are stored.