Did the Fireworks AI breach at Notion expose your CV?

What happened in the Fireworks AI breach at Notion?

Attackers who broke into Fireworks AI, an inference company that ran some of the open-weight models behind Notion AI, got access to Notion AI chat transcripts from fewer than 1% of Notion workspaces. Notion confirmed this in November 2026, and it's Fireworks' second breach in about a month. The transcripts came from a dataset Notion kept for Insights, a feature that shows admins how their teams use AI. They contain everything a user typed into the chat and every reply the model gave. Notion says most transcripts weren't tagged with an author or a workspace and didn't include tool-call results. AI Meeting Notes weren't affected unless someone pasted them into a chat.

The timeline moved fast. On November 2, Fireworks told Notion about an exposed dataset that it described at that point as synthetic test data. By November 3, Notion had cut off traffic to Fireworks, deleted its data from the vendor's systems and stopped training runs. On November 8, Fireworks confirmed that real customer data had been accessed, Notion users' data included. The attacker reportedly got into Fireworks' development machines through its cloud provider. Other Fireworks customers lost billing details, datasets and unfinished model weights in the same incident. A separate intrusion had been detected on October 6, when stolen internal credentials exposed some customer API keys.

The awkward part is that Fireworks had a contractual commitment to zero data retention for Notion's data. Fireworks says that default held and that the attackers reached customer data stored for a separate purpose. Neither company has said publicly which feature held the transcripts. That gap is the real lesson for anyone job hunting. You never chose Fireworks, and you probably didn't know it existed. You typed into Notion, your words went to a vendor you'd never heard of, and a promise not to keep data turned out to have an exception. Notion has since switched off the Insights dataset and stopped sending open-weight model traffic through Fireworks.

Why should job seekers care about leaked AI chat transcripts?

Job seekers should care because a job-search chat is one of the most personal things you'll ever type into an AI tool. A typical "rewrite my CV for this job ad" prompt includes your full name, mobile number, personal email, home town or full address, every employer and date, and often your current pay alongside the figure you're hoping for. Add a cover letter draft and you've also said which company you're leaving and why. Most chats in a work tool are about meeting agendas or project specs. If one of those leaks, it's embarrassing. If your job-search chat leaks, it's a ready-made profile of a real person, written by that person.

Notion's point that most transcripts weren't labelled with an author or workspace helps less than you'd think. That's reassuring for a chat about a quarterly roadmap. It's far less comforting for a CV, which exists to identify you: your name at the top, your phone number underneath and a LinkedIn profile beside it. A pasted CV puts your name back on the transcript all by itself. The same goes for a cover letter you signed, or a note like "chase the recruiter about the senior PM role, current package 95k, notice period two months." Removing the label from a transcript doesn't help much when the text inside says who wrote it.

How do you check whether your Notion AI chats were exposed?

Start with your workspace owner. Notion has given owners of potentially affected workspaces a way to view the exposed data through a security incident review, so the owner can see what was involved and an ordinary member can't. If you run a personal workspace, the owner is you, so check your account and the email address you signed up with for messages from Notion. If you polished your CV with Notion AI inside your employer's workspace, which happens more often than people admit, you'll have to ask IT or the admin. That's an uncomfortable conversation when you're job hunting quietly, but it's better than guessing.

Next, take stock yourself. Search your Notion AI chat history and pages for words like "CV", "resume", "cover letter", "salary", "interview", "notice period", your surname and your phone number. Note every chat that contains a credential, because Notion's own advice is to change any passwords, API keys and other secrets pasted into Notion AI during the incident window. For job seekers, that usually means job-board logins, passwords for an employer's careers site or a personal email password typed into a "help me organise my applications" chat. If you've ever given an assistant direct access to those accounts, lock down AI agent permissions for your inbox and job-board logins too.

If you can't confirm either way, assume your data was exposed and respond in proportion. Fewer than 1% of workspaces is low odds, but you can't search an anonymised transcript dump yourself, and cleaning up costs you very little. Change every credential that appeared in a chat, starting with your main email, because a reset link for every other account lands there. Turn on two-factor authentication for email, LinkedIn and any job boards that support it. Then treat unsolicited recruiter contact with extra suspicion for the next few months. That's especially true of messages that move quickly to a messaging app or ask for ID documents before anyone has interviewed you.

What should you delete and never paste into an AI chat?

Delete every job-search chat you no longer need, then make a permanent rule: contact details, ID numbers, salary history and passwords stay out of AI chats. Here's a ten-minute cleanup. Spend the first three minutes searching for and deleting old CV, cover-letter and interview-prep chats in Notion AI and any other assistant you use. Spend the next three going through workspace pages where AI drafted text for you, such as an old "Job hunt 2025" tracker with recruiter phone numbers. Use the last four changing the credentials you found. Deleting on your side won't recall copies a vendor already holds, but it shrinks what the next breach can take.

The never-paste list is short. Leave out your phone number, home address, personal email, date of birth and any national ID number, such as a US Social Security number, an Aadhaar or PAN number in India, a UK National Insurance number or an Israeli ID number. The same goes for passport and visa numbers, bank details, your current salary and pay history, and your references' contact details. None of these improve the feedback you get. An AI can judge whether your bullet points show impact without knowing your street name. Salary history rarely belongs on a CV anyway, and a growing number of US states and cities bar employers from asking for it.

Stripping a CV takes about two minutes once you've made a redacted working copy. Replace your name with "Candidate", swap your phone and email for placeholders, cut your address down to a city and remove your date of birth and photo. If your search is confidential, swap your current employer's name for a description like "Series B fintech, about 200 staff". Keep job titles, dates, skills and achievements, because that's what any useful analysis reads. Paste the redacted copy into AI tools, then add your real details back into the final file on your own computer. For more detail, see this redaction checklist to run before any AI tool sees your resume.

How do you choose a CV analysis tool that asks only for what it needs?

Choose a tool built for one job that works perfectly well with a redacted CV. Before you upload anything, ask five questions. Is this a purpose-built CV tool, or a general assistant that keeps your chat history by default? Does it say which AI providers process your text? Can you delete what you've uploaded? Does it ask for more than an email address to get started? And does its feedback still make sense when your contact details are placeholders? If it complains that your CV has no phone number, that's fine. If it can't score your experience without one, find another tool.

The Notion incident shows why the difference between a general assistant and a dedicated CV tool matters. A general workspace assistant keeps your CV chat alongside everything else you've written, and that history can be logged for features you never think about. Insights, the admin analytics feature, is exactly that kind of feature. With a dedicated CV tool, you upload a CV and maybe a job ad, and that's all. You can run a free CV analysis on your redacted copy by uploading a PDF, Word file or image. You'll get a score out of 100, five category scores and a layout review, and none of them depend on your phone number. Paste a job ad's text to see which skills you're missing.

Your workflow matters as much as which tool you pick. Keep a master CV on your own computer with your real contact details, and only give AI tools the redacted version. If you're starting fresh, you can build a clean, ATS-friendly CV by chatting through your experience, export it, then add your phone and email locally before you apply. Self-hosted and open-source tools carry their own risks, because they often store API keys and files you didn't realise they kept. My view: the safest CV you can give an AI tool is a dull one, with no phone number, no address and no salary. Your feedback will be just as good, and a breach will have nothing personal to take.

Frequently asked questions