Notion says it revoked exposed API keys on November 11 after finding them in affected users’ messages during its investigation into the Fireworks AI incident.
The update adds a containment measure to an incident affecting fewer than 1% of Notion workspaces. Notion says the exposed dataset included chat transcripts used by its Insights feature.
Most affected workspaces’ transcripts lacked labels identifying users or workspaces, but that does not remove sensitive information users may have typed into conversations.
Notion had disconnected from Fireworks by November 3. It has disabled Insights and stopped serving open-weight models through the provider. The company says no other Notion features were affected.
Affected customers should review the data through instructions Notion emailed them and rotate any exposed passwords, API keys or credentials pasted into chats. Notion says customers it has not contacted have not been identified as affected and need take no action for now; its investigation continues.
