Notion AI chats exposed access keys after supplier breach
A November 11 action tied to a supplier breach shows how credentials pasted into AI chats can leak even when the chats carry no ownership label.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- The incident came to light on November 11, 2026, and involved a supplier breach tied to Notion.
- Users had put access keys directly into AI chat messages.
- Chats without ownership labels can still expose credentials embedded in the text.
- Anyone who pasted API keys or wallet-related secrets into an AI tool should treat them as compromised and rotate them.
Access keys that Notion users pasted into AI chats were exposed after a breach at a supplier, according to a CryptoSlate report on a November 11 action. We don't have many details. The takeaway doesn't need them.
What we know
Here's the mechanism: a chat with no ownership label can still leak the credentials inside its messages. Nobody has to work out whose chat it was. If the key is in the text, whoever holds the text holds the key.
The exposure came through a supplier. Users weren't doing anything exotic. That's the uncomfortable bit. You can lock down your own account and still lose a secret that sits in someone else's system.
The source summary doesn't say how many keys leaked, which services they opened up, or who carried out the breach. I won't guess at any of it.
Why it matters
Crypto users paste things into AI chats all the time. Exchange API keys, RPC endpoints, bot configs, scripts with secrets baked in. It feels private. Once a third party touches the data, it isn't.
A leaked exchange API key with trading or withdrawal permissions puts real money at risk. Even a read-only key shows your balances and activity.
The fixes are dull but they work:
- Rotate any key you've ever pasted into an AI tool or shared workspace.
- Use keys with minimal permissions and withdrawal whitelists.
- Keep seed phrases and private keys out of chats entirely. Always.
The open question is how many teams actually know what's sitting in their old AI chat history. My guess is most don't.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇦🇺 Showing sites that accept players from Australia Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-oriented casino that turns away only New Jersey. The cashier takes crypto, but the site publishes fewer specifics than any operator we list.
- KYC
- Required
Restricted countries: New Jersey (US).
More info Less info
Why we chose it: One of the widest crypto line-ups of any book we list - seven coins with fast payouts - aimed squarely at Asia and Latin America rather than the US or Western Europe.
- Licence
- Curacao
Restricted countries: Austria, Belgium, Bulgaria, Cyprus, Czechia, Germany, Denmark, Estonia and 21 more.
More info Less info
Why we chose it: Built for American bettors, priced accordingly. Biggest welcome bonus of the five, attached to the heaviest rollover of the five.
- Online since
- 1994
- Licence
- Curaçao
- Payout time
- 24–48 hours (crypto)
- Wagering
- 18x sportsbook / 30x casino
- KYC
- Required
Restricted countries: Belgium, Costa Rica, Croatia, Curaçao, Aruba, Sint Maarten, Caribbean Netherlands, France and 11 more.
Mia Chen
Mia digs into DeFi and on-chain data, translating protocol mechanics into plain English for everyday readers.
Related News
Across Protocol site hijack drains $401,900, mostly from one Aave user
Unocoin's login suspension drags on, and the exchange has flagged ETH transfers tied to BitGo
Chainstack says an AI-powered breach exposed customer data
