Fireworks AI security breach impacts Notion and their customers

Notion has disclosed a security incident originating from one of its AI vendors, Fireworks AI, leading to the potential exposure of certain Notion AI chat data. While impacting a small fraction of users, the event underscores the complexities of third-party AI integrations and data security.<ul><li>The Breach: Fireworks AI, an AI infrastructure platform utilized by Notion, experienced a security incident that may have exposed some Notion AI chat transcripts.</li><li>Limited Scope: Fewer than 1% of Notion workspaces are estimated to be affected by this breach.</li><li>Data at Risk: The compromised data includes "unattributable chat sessions" from Notion AI. These transcripts were not linked to specific users or workspaces and did not contain tool call results, but Notion advises treating them as if they were exposed.</li><li>Vendor's Role: Notion used Fireworks AI for classification tasks within its "Insights" feature (tracking AI usage) and as a general provider for serving open-weight AI models.</li><li>Notion's Response: Immediately after learning of the incident, Notion severed all connections with Fireworks AI, purged its data from their systems, and halted traffic. The "Insights" feature is now disabled, and open-weight models are no longer delivered via Fireworks.</li><li>User Guidance: Affected workspace owners have been directly notified. Notion recommends that users, as a precautionary measure, rotate any sensitive credentials (like passwords or API keys) if they were entered into Notion AI during the period of potential exposure.</li></ul>This incident serves as a pertinent example of the supply chain vulnerabilities that arise when integrating third-party AI services. Notion's swift response aims to contain the damage, yet it emphasizes the continuous need for robust security protocols in an increasingly interconnected AI ecosystem.