As the disclosures from Notion indicate, the chat transcripts include any input to or output from the model that was written to the chat, confirming the extent of an intrusion that struck its AI infrastructure. Online document editor and notetaker Notion issued the disclosure after cloud platform Fireworks AI suffered a cyberattack that compromised developer systems and customer records. According to company records, Fireworks AI operates a platform utilized by tens of thousands of customers worldwide to run open AI models, a roster that features legal tech company Harvey and AI company Cursor. What executives must now weigh is the concrete security exposure created when core enterprise applications outsource their model inference pipelines to external vendors.
Outsourcing inference infrastructure shifts operational security risks directly into the software supply chain, turning third-party access points into vectors for data exfiltration. In this case, an attacker breached the cloud provider utilized by Fireworks AI to gain unauthorized entry into a development system. Once inside, the cybercriminals took billing information belonging to Fireworks customers alongside selected datasets. As Notion confirmed, Fireworks initially alerted it to the incident before confirming that attackers had stolen Notion customer data.
Compromise Across the Inference Tier
For Notion, the perimeter breakdown rapidly reached end-user activity. The breach affected around 1% of Notion's own customers, specifically compromising the chat logs of Notion AI users who relied on the platform's Insights capability.
As Notion stated, the stolen records included any model inputs and outputs submitted by users to the chat.
According to Notion, much of the compromised material was unattributable, meaning investigators could not determine which specific customer originated the records. To stem the exposure on November 3, Notion disconnected its systems from Fireworks, deleted the data stored in its systems, and stopped all connectivity between the two organizations.
Monetizing Compute and Recurring Vulnerabilities
One might ask whether an attack on a specialized API provider represents an isolated incident rather than an infrastructure-wide security problem. The operational realities tell a different story. Fireworks confirmed that this incident marks its second breach in as many months, following an earlier security compromise in October.
Cybercriminals are targeting inference infrastructure to harvest and monetize large language model tokens on unauthorized markets.
As Fireworks stated, the attackers are financially motivated, directing their operations toward selling tokens obtained through breached access to large language models. This mechanism enables unauthorized third parties to burn through expensive AI model usage without spending their own computational or financial resources. The compromise demonstrates how vulnerabilities in specialized inference hosting can convert developer environments into resalable compute commodities while exposing enterprise customer records in the process.
Can platforms that host open models convince enterprise clients like Notion, Harvey, and Cursor to maintain production workloads when recurring intrusions repeatedly compromise customer chat logs and billing systems?
What it signals
Immediate exposure of enterprise chat logs and unauthorized token reselling is the direct operational cost of outsourcing model execution to specialized platforms, as demonstrated by the Fireworks AI breach. While enterprise clients like Notion act swiftly to sever integrations and scrub infrastructure, specialized inference providers reveal persistent vulnerabilities across their development environments. Experiencing two security breaches in just two months completely undermines the promise of enterprise-grade security for open-source model hosting.