Notion users put access keys in AI chats. A supplier breach exposed them

Notion disabled exposed API keys on Nov. 11 after finding them in AI chats affected by a breach at supplier Fireworks AI, according to its updated security advisory . These keys let software access workspace data within the permissions their owners granted. Notion says the incident affected fewer than 1% of its workspaces. The exposed dataset included Notion AI chat transcripts used for its Insights feature. For the vast majority of affected workspaces, those transcripts lacked labels identifying who wrote the chats or which workspace they belonged to, and contained no tool-call results. Information inside the messages could still connect a conversation to a user, workspace or company, however. The API keys found in affected messages show why missing ownership labels still leave secrets in the text.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CryptoSlate.