Notion users put access keys in AI chats. A supplier breach exposed them

Notion disabled exposed API keys on Nov. 11 after finding them in AI chats affected by a breach at supplier Fireworks AI, according to its updated security advisory. These keys let software access workspace data within the permissions their owners granted.

Notion says the incident affected fewer than 1% of its workspaces. The exposed dataset included Notion AI chat transcripts used for its Insights feature.

For the vast majority of affected workspaces, those transcripts lacked labels identifying who wrote the chats or which workspace they belonged to, and contained no tool-call results. Information inside the messages could still connect a conversation to a user, workspace or company, however. The API keys found in affected messages show why missing ownership labels still leave secrets in the text.

Revocation addressed exposed keys inside messages.

Schematic illustration. No real credential is shown, and key misuse is not established.

Sources and evidence

Sources

1. Notion incident advisory

Supporting facts

• Notion says it revoked exposed Notion API keys on November 11 after finding them in affected user messages during its investigation of the Fireworks AI incident. [1]
• Notion says the affected dataset included Notion AI chat transcripts used for Insights; for the vast majority of impacted workspaces the chats were not labeled with their author or workspace and did not contain tool call results. [1]
• Notion says there was no information linking those unattributable chats to users, workspaces or companies beyond what the chat transcripts themselves contained. [1]

Method

Schematic transcript cross-section connects absent ownership labels to a credential retained in message text, then to the reported November 11 revocation. No real transcript or credential is reproduced.

Scope

Schematic illustration. No real credential is shown, and key misuse is not established.

Infographic by CryptoSlate

Notion's API security guidance says someone holding a token can make requests within its capabilities and content permissions, potentially exposing or changing workspace content. An internal connection's access is limited to pages shared with it and its assigned capabilities.

The key revocations came after Notion's initial disconnection from Fireworks. After a Nov. 2 notification appeared to involve synthetic testing data only, Notion says it disconnected its systems, deleted data held in the Fireworks system and stopped communications by the morning of Nov. 3.

Fireworks then notified Notion of potential customer-data access on Nov. 6 and confirmed the new dataset on Nov. 8. Notion identified the Insights transcripts in that material.

Notion has disabled Insights during its investigation and stopped serving open-weight models through Fireworks. It says no other Notion features were affected. Its advisory does not report misuse of the Notion keys covered by the Nov. 11 revocation.

In its Nov. 9 incident update, Fireworks described impacts to resource metadata and billing information, as well as secrets, datasets and incomplete model weights for a limited set of accounts.

Fireworks separately says it has detected no impact to Inference, Training SDK or Nexus, services that have zero data retention by default. Those findings remain provisional while its investigation continues.

For affected Notion customers, the company's advice extends beyond the keys it revoked. It recommends reviewing the impacted data securely inside the workspace, treating that material as exposed and rotating passwords, API keys or other credentials pasted into Notion AI during the incident timeframe. Notion says it has contacted customers it identified as affected.