Notion AI chats exposed access keys after supplier breach
A November 11 action tied to a supplier breach shows how credentials pasted into AI chats can leak even when the chats carry no ownership label.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- The incident came to light on November 11, 2026, and involved a supplier breach tied to Notion.
- Users had put access keys directly into AI chat messages.
- Chats without ownership labels can still expose credentials embedded in the text.
- Anyone who pasted API keys or wallet-related secrets into an AI tool should treat them as compromised and rotate them.
Access keys that Notion users pasted into AI chats were exposed after a breach at a supplier, according to a CryptoSlate report on a November 11 action. We don't have many details. The takeaway doesn't need them.
What we know
Here's the mechanism: a chat with no ownership label can still leak the credentials inside its messages. Nobody has to work out whose chat it was. If the key is in the text, whoever holds the text holds the key.
The exposure came through a supplier. Users weren't doing anything exotic. That's the uncomfortable bit. You can lock down your own account and still lose a secret that sits in someone else's system.
The source summary doesn't say how many keys leaked, which services they opened up, or who carried out the breach. I won't guess at any of it.
Why it matters
Crypto users paste things into AI chats all the time. Exchange API keys, RPC endpoints, bot configs, scripts with secrets baked in. It feels private. Once a third party touches the data, it isn't.
A leaked exchange API key with trading or withdrawal permissions puts real money at risk. Even a read-only key shows your balances and activity.
The fixes are dull but they work:
- Rotate any key you've ever pasted into an AI tool or shared workspace.
- Use keys with minimal permissions and withdrawal whitelists.
- Keep seed phrases and private keys out of chats entirely. Always.
The open question is how many teams actually know what's sitting in their old AI chat history. My guess is most don't.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇬🇧 Showing sites that accept players from United Kingdom Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-oriented casino that turns away only New Jersey. The cashier takes crypto, but the site publishes fewer specifics than any operator we list.
- KYC
- Required
Restricted countries: New Jersey (US).
More info Less info
Why we chose it: The LatAm door of the BetNow platform: Spanish-first, a 200% welcome at 20x rollover, and a weekly 2% rebate. Crypto rails unconfirmed — check before depositing.
- KYC
- Required
Restricted countries: Australia, Costa Rica, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau, Iraq and 15 more.
Mia Chen
Mia digs into DeFi and on-chain data, translating protocol mechanics into plain English for everyday readers.
Related News
Across Protocol site hijack drains $401,900, mostly from one Aave user
Unocoin's login suspension drags on, and the exchange has flagged ETH transfers tied to BitGo
Chainstack says an AI-powered breach exposed customer data
