Trade coverage on November 9–10 claims Notion told customers that a Fireworks AI breach exposed data from some user workspaces, including a dataset built from customer agent runs stored on the inference vendor. Fireworks’ November 9 bulletin does confirm that datasets and incomplete model weights were accessed for a limited set of accounts—but it does not name Notion or describe workspace content. Notion’s public security advisories show no Fireworks-specific notice we could read on November 10. If you run Notion AI, Cursor, or custom fine-tunes on Fireworks, treat your vendor email as scope—not headlines—and rotate any API key or dataset Fireworks could read.
explainx.ai has the full news timeline for the November 9 Fireworks bulletin and same-day customer fallout reporting.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Only if Fireworks or Notion emails you or you stored non-ZDR datasets, weights, or eval secrets on Fireworks. Public customer lists are not proof of impact. |
| Did Notion confirm workspace compromise publicly? | Not on notion.com/security/advisories as of Nov 10. Aggregator headlines are not primary sources. |
| What did Fireworks verify? | Billing data, secrets, datasets, and incomplete weights for some accounts; Oct 23–24 cloud-provider pivot into R&D hosts; LLMjacking motivation cited. |
| Were live Notion pages hacked via Fireworks? | Unverified. No Notion bulletin; Fireworks does not describe SaaS workspace APIs. |
| Is there a fix? | Fireworks disabled dataset upload/download, rotated credentials, and notifies impacted tenants. Notion has not published matching remediation steps publicly. |
| Does data leave my machine? | Yes when products send prompts or training rows to Fireworks inference—that is separate from whether this breach touched your tenant. |
What changed on November 9 (verified)
Fireworks published an update to its October 2026 security incident bulletin. The verified categories expanded beyond October’s evaluation-job secrets:
- October 6 path — misuse of internal credentials; environment variables in evaluation jobs for a limited number of accounts (unchanged story from the October bulletin).
- October 23–24 path — a third-party cloud provider hosting Fireworks R&D machines had its own incident; on October 24 an unauthorized party used that route to reach Fireworks development machines and run a workload with additional customer data impact. Fireworks says it detected activity the same day and saw no further successful access on the customer-facing platform after October 25.
- Data categories — resource metadata, billing profiles, and—for certain customers—a subset of incomplete model weights and datasets.
Fireworks links the activity to financially motivated LLMjacking (reselling stolen inference access), citing Google Threat Intelligence Group and Mandiant’s November 2 post. It disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while investigating, and says Inference, Training SDK, and Nexus remain zero data retention (ZDR) with no detected impact.
That is the authoritative mechanism for anything stored on Fireworks outside ZDR inference traffic. It does not, by itself, prove that Notion workspace pages were read—only that some Fireworks-held customer artifacts in the affected categories were accessed.
What headlines claim about Notion (unverified details)
Overnight trade aggregators and social posts (including posts that rewrote earlier tweets) assert that:
- Notion said a Fireworks incident exposed data from some user workspaces.
- The exposure involved a dataset Notion built from customer agent runs to train a classifier, stored on Fireworks.
- Fewer than 1% of workspaces were affected.
What we checked:
| Claim | Source we could use | Status |
|---|---|---|
| Fireworks datasets/weights accessed | Fireworks Nov 9 bulletin | Verified (limited accounts; categories named) |
| Fireworks working with Notion | Bloomberg Law quoting a Fireworks spokesperson | Verified quote — coordination, not scope |
| Notion workspace compromise | Notion security advisories page | Not published there on Nov 10 |
| Agent-run classifier dataset on Fireworks | Notion or Fireworks primary pages | Unverified — no matching bulletin text |
| “Fewer than 1% of workspaces” | Notion primary | Unverified |
Notion’s Schedule A sub-processors list (updated September 3, 2026) does name Fireworks AI for AI model inference in the United States, alongside Anthropic, OpenAI, and Google Cloud. That is expected architecture for Notion AI features—it is not proof that this breach touched live workspace content. Fireworks’ own customer story pages describe Notion using Fireworks for latency and enterprise AI workflows, which implies inference routing, not necessarily long-lived page exports sitting in a dataset bucket.
Until Notion posts an advisory or emails your admin with workspace-level scope, treat “workspace compromise” language in secondary headlines as unconfirmed.
Attack chain (Fireworks-verified)
This is the host-side chain Fireworks documents—not a prompt-injection story:
Oct 6 → Stolen/misused Fireworks internal creds → eval-job env vars / secrets (limited accounts)
Oct 23 → Incident at third-party cloud hosting Fireworks R&D machines
Oct 24 → Attacker pivots from provider into Fireworks dev machines → unauthorized workload
→ Additional access to internal app holding billing metadata + some datasets/weights
Oct 25 → Fireworks says customer-facing platform path closed; ongoing hardening with Unit 42
Nov 9 → Public bulletin expanded; dataset features disabled; customer notifications continue
The open questions for enterprise AI products like Notion are tenant-specific:
- Did your Fireworks project use batch datasets, fine-tuning uploads, or evaluation jobs (non-ZDR), or only ZDR inference?
- Did any Fireworks-held dataset contain end-user workspace text versus synthetic or redacted training rows?
Fireworks says it is notifying impacted customers directly. That email—not press naming Harvey, Cursor, or Notion—is the right scope document, matching how we handled Fireworks fallout reporting and LLMjacking economics.
What this means if you run AI coding agents
If you are a Notion end user or admin
- Check official channels first. Notion’s security advisories and any in-admin banner or email beat reposted tweets.
- Separate products. Notion MCP and Notion AI integrations in Claude or Cursor are local agent configs; this incident is about Notion’s cloud subprocessors, not your
NOTION_API_KEYin a repo—unless Fireworks notices say otherwise. - Do not panic from customer lists. Forbes and Bloomberg name large Fireworks customers for context; DailyMech’s Nov 9 recap explicitly warns that being named is not impact.
If you fine-tune or batch on Fireworks
The verified risk lands where Fireworks stores artifacts at rest:
- Dataset upload / batch inference paths (currently disabled for self-serve upload/download).
- Evaluation jobs that embed third-party API keys in environment variables (October path).
- Incomplete weights on vendor storage—not the same as live ZDR chat completions.
Actions mirror Black October guidance and our first-24-hours vendor breach runbook:
- Search monorepos for
fireworks.ai,FIREWORKS_API_KEY, and dataset resource IDs. - Rotate every key Fireworks could read, including downstream model providers referenced in eval secrets.
- Review usage logs for unfamiliar models, regions, or token spikes after October 6 and October 24.
- Prefer ZDR inference for agent harnesses until dataset features return with clearer controls.
If you build agents that sync user content to inference vendors
The unverified Notion classifier story is a useful design warning even without confirmation:
- Agent transcripts and tool traces can become training rows when product teams fine-tune routers or safety classifiers.
- Those rows often sit on the same vendor account as production inference—even when marketing promises ZDR on the hot path.
- Incident scope then becomes “what was in the dataset bucket,” not “was chat logged,” which is harder to explain to users.
Australia’s November 10 policy response to rogue agents (mandatory incident reporting) is a different layer—regulators—but the operational lesson matches: keep your own timeline of what agents touched and when you knew.
How ZDR marketing interacts with dataset storage
Fireworks draws a bright line in its bulletin between products that do not retain prompts by default and features that necessarily store blobs. Inference, Training SDK, and Nexus are described as ZDR, meaning the vendor’s default story is that live agent traffic does not sit in a durable customer bucket. Batch Inference, dataset-based training, and evaluation jobs with embedded secrets are different classes: they require objects at rest on Fireworks or its cloud providers.
That split matters when you read “customers substantially moved off Fireworks” quotes in Forbes interviews. Some teams may be reacting to repeat host incidents and communications friction, while others may have been using only ZDR routes and still face reputational risk without a confirmed data-category hit. Your inventory question is binary: did we ever upload a tarball, JSONL trace file, or fine-tune manifest to Fireworks after September 2026? If yes, you are in the dataset/weights risk class Fireworks names. If you only set base_url to Fireworks for chat completions and never touched batch upload UIs, the bulletin still says no detected impact on those SKUs—but you should still rotate keys that lived in evaluation secrets because October’s first path touched env vars in some accounts.
Parallel you may have missed: Cursor and legal agents
The same Bloomberg quote that names Notion also names Cursor. Cursor is a coding agent surface many readers run locally. Nothing in Fireworks’ public text says Cursor transcripts leaked; the link is vendor coordination, not product telemetry. Harvey and other legal-agent vendors appear in paywalled trade pieces summarized by outlets like MLQ; those summaries explicitly note they could not confirm a second incident beyond Fireworks’ single expanded October campaign. When a headline says “second hack,” map it to Fireworks’ timeline table (October 6 secrets path plus October 23–24 cloud pivot), not necessarily a new unpublished breach.
If you operate a small team that routes LiteLLM or OpenRouter-style gateways through Fireworks, apply the same dataset vs ZDR split: gateways often log metadata locally even when the upstream is ZDR. Your gateway host becomes the sensitive store, not Fireworks—unless you also uploaded training artifacts.
What Beam can and cannot do here
Beam is local-first observability for Claude Code, Codex, and similar agents on your machine. It does not sit inside Notion’s cloud or Fireworks’ control plane.
What it can help with on a dev laptop:
- Heuristic scans of skills and MCP configs before you run them (eleven patterns plus an MCP version-pin check), including credential-shaped strings in files agents touch (monitoring basics).
- PreToolUse deny on Claude Code and Codex when workspace policy is enforce—hook-based, not a kernel sandbox, and fail-open if cached policy is missing or expired. Useful if an agent tries to curl a dataset upload or paste a Fireworks key into a public gist.
What it cannot do:
- Prove whether Notion copied workspace text into a Fireworks dataset.
- Replace vendor breach email, tenant admin review, or Fireworks console key rotation.
- Block cloud-side training pipelines you never run through a local agent hook.
Frequently asked questions
Did Notion publish a security advisory about the Fireworks incident?
Not on the public advisories page we fetched November 10, 2026.
What did Fireworks verify about datasets?
Limited accounts; subsets of datasets and incomplete weights plus billing metadata; investigation ongoing.
Does being a Fireworks customer mean Notion workspaces were breached?
No—customer names in press are not scope. Wait for direct notice.
What is the agent-training dataset claim?
Reported by aggregators and social posts only; not in Fireworks or Notion bulletins we could read.
What should I do now?
Read vendor email, rotate Fireworks-related secrets, audit non-ZDR features, watch inference logs.
Can Beam see Notion-to-Fireworks sync?
No—Beam is on-device agent observability, not SaaS DLP.
Related reading
- Fireworks AI October breach update: billing, weights, LLMjacking
- GTIG and Mandiant on LLMjacking and stolen keys
- Black October: AI developer platforms and key abuse
- First 24 hours after a vendor breach
- OpenAI agents and Australia’s new reporting push
- What is AI agent monitoring?
Incident scope reflects Fireworks and Notion pages available as of November 10, 2026. Notion may publish an advisory later; re-check notion.com/security/advisories and your admin inbox.