Fireworks AI breach via its cloud provider exposed Notion AI chat transcripts

What happened

Fireworks AI, a platform developers use to run and access open AI models, has confirmed that a cyberattack exposed some of its customers' data. According to TechCrunch, the intruders did not break into Fireworks directly — the company said they first compromised one of its cloud providers and used that access to reach a Fireworks development system.

From that foothold, the attackers obtained customers' billing information along with some datasets. Fireworks says it serves tens of thousands of customers globally, including legal technology firm Harvey and the AI company Cursor.

How Notion was drawn in

At least one confirmed victim is Notion, the online document and note-taking service. In its own disclosure, Notion said the breach affected roughly 1% of its customers. The company said Fireworks alerted it to a security incident and later confirmed that hackers had stolen some Notion customer data.

Notion said that on November 3 it disconnected its systems from Fireworks, deleted the data stored on Fireworks' systems, and cut all connectivity between the two companies.

In a disclosure published this week, Notion confirmed that the stolen material included chat transcripts from Notion AI customers who had used the 'Insights' feature. Those transcripts are broad: Notion said they capture anything written into the chat, both the inputs sent to the model and the outputs it returned. The company added, however, that much of the data could not be traced back to a specific customer.

What the attackers wanted

According to TechCrunch, Fireworks believes the hackers were financially motivated, but the stolen data may not have been the main prize. The company says the attackers' goal appears to be selling access tokens gained by breaching large language model infrastructure. Buyers of such tokens can run LLM workloads on someone else's bill, consuming expensive AI compute without paying for it themselves.

A second incident in two months

The breach follows a separate security incident in October, making this the second compromise of the company in as many weeks-to-months, according to TechCrunch. The repeat raises questions about Fireworks' security posture at a time when its customers — and their customers in turn — are exposed to failures at every layer of the stack.

Why it matters

The incident is a textbook AI supply-chain compromise. Notion did not suffer a direct break-in; its customers' AI conversations leaked because a vendor, and then that vendor's cloud provider, were breached. Any company shipping AI features on top of a third-party inference platform inherits that platform's risks, and the platforms themselves inherit their cloud providers' risks.

The data at stake is also unusually sensitive. AI chat transcripts can contain a user's unfiltered working notes, questions and drafts — material people might never place in a shared document. Notion's point that much of the stolen data could not be tied to individual customers may limit the fallout, but it is cold comfort for anyone whose model inputs and outputs are now in someone else's hands.

Finally, the reported motive — reselling stolen model access — signals a shift in how attackers monetize AI infrastructure. As LLM usage becomes a significant cost line for businesses, access itself becomes a commodity worth stealing, which means AI providers and their customers now have to defend both their data and their compute budgets.