Fireworks AI, a startup that rents out infrastructure for running and fine-tuning AI models, has confirmed a second, more serious security breach that exposed customer billing records, datasets and unfinished model weights — and this time the fallout has reached outside customers, including the workplace software company Notion.
In an updated security bulletin published November 9, Fireworks said an October 23 breach at a third-party cloud provider let an unauthorized party reach its own development machines the next day, where they ran an unauthorized workload. The company says no payment card numbers were exposed and that its core inference service was unaffected, but that billing addresses, invoices, account balances and, for a limited set of accounts, secrets, datasets and incomplete model weights were accessed.
Notion's Chat Transcripts
Notion's own security advisory, reported in detail by MLQ.ai, says Fireworks told it on November 6 that the incident affected fewer than 1% of Notion's workspaces. An earlier dataset Fireworks flagged on November 2 turned out to hold only synthetic test data, prompting Notion to cut ties with Fireworks days later. But on November 8, Fireworks confirmed a second, real dataset containing AI chat transcripts from Notion's "Insights" feature — for most affected workspaces, not tied to a specific user or company. Notion says its own systems were never breached, but it has disabled Insights, stopped routing open-weight models through Fireworks, and told affected customers to rotate any passwords or API keys they had pasted into Notion AI during the incident window.
Bloomberg reported that Fireworks is "actively working with our customers to manage the incident, including Notion, Cursor and others," while The Information reported separately that legal AI company Harvey was also notified of the breach. Fireworks, which has more than 10,000 customers and was valued at $17.5 billion as of a funding round in July, said in a statement that it "takes this matter very seriously and is connecting directly with customers to provide appropriate support." According to TokenPost, at least two large customers have already moved most of their business elsewhere.
Fireworks has brought in Palo Alto Networks' Unit 42 to investigate, revoked and reissued credentials, and temporarily disabled self-serve dataset uploads and downloads. The company says it believes the intrusion is linked to a financially motivated group engaged in "LLMjacking" — reselling stolen access to AI models on black markets — rather than state-sponsored espionage.
