Chameleon response to Fireworks AI + Notion security incident

Incident Report for Chameleon

Resolved

Fireworks AI has disclosed security incidents affecting a limited set of its customers (https://fireworks.ai/security/bulletins/october-2026-security-incident-update). Chameleon's product did not send customer or end-user requests to Fireworks. Copilot and Chameleon's other AI features run on other providers and we have not been contacted by Fireworks regarding this incident.

Chameleon did not store any datasets, models or secrets with Fireworks but as a precaution, we have stopped using Fireworks and revoked all of our Fireworks API keys.

Our engineering team used a Fireworks-hosted model in a limited capacity, as one of several AI assistants that help plan and review changes to our own code. Fireworks has not reported that request traffic was accessed, and it does not store prompts or outputs.

The same incident exposed Notion AI chat transcripts for some Notion workspaces (https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor). Chameleon was not part of that exposure and we do not use Notion AI.

Posted Nov 09, 2026 - 17:00 EST