Notion AI chats exposed access keys after supplier breach
A November 11 action tied to a supplier breach shows how credentials pasted into AI chats can leak even when the chats carry no ownership label.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- The incident came to light on November 11, 2026, and involved a supplier breach tied to Notion.
- Users had put access keys directly into AI chat messages.
- Chats without ownership labels can still expose credentials embedded in the text.
- Anyone who pasted API keys or wallet-related secrets into an AI tool should treat them as compromised and rotate them.
Access keys that Notion users pasted into AI chats were exposed after a breach at a supplier, according to a CryptoSlate report on a November 11 action. We don't have many details. The takeaway doesn't need them.
What we know
Here's the mechanism: a chat with no ownership label can still leak the credentials inside its messages. Nobody has to work out whose chat it was. If the key is in the text, whoever holds the text holds the key.
The exposure came through a supplier. Users weren't doing anything exotic. That's the uncomfortable bit. You can lock down your own account and still lose a secret that sits in someone else's system.
The source summary doesn't say how many keys leaked, which services they opened up, or who carried out the breach. I won't guess at any of it.
Why it matters
Crypto users paste things into AI chats all the time. Exchange API keys, RPC endpoints, bot configs, scripts with secrets baked in. It feels private. Once a third party touches the data, it isn't.
A leaked exchange API key with trading or withdrawal permissions puts real money at risk. Even a read-only key shows your balances and activity.
The fixes are dull but they work:
- Rotate any key you've ever pasted into an AI tool or shared workspace.
- Use keys with minimal permissions and withdrawal whitelists.
- Keep seed phrases and private keys out of chats entirely. Always.
The open question is how many teams actually know what's sitting in their old AI chat history. My guess is most don't.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇯🇵 Showing sites that accept players from Japan Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-facing book that pays a premium for crypto deposits: 125% against 100% for cash, with fee-free deposits across five coins.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
More info Less info
Why we chose it: Phemex is a derivatives-first venue for Europe, Asia and Latin America. Good engine, mid-size liquidity, and a blocklist that grew in 2025.
- Online since
- 2019
- Licence
- Seychelles
- KYC
- Required
Restricted countries: United Arab Emirates, Afghanistan, Australia, Belgium, Bermuda, Belarus, Ontario (Canada), China and 18 more.
More info Less info
Why we chose it: BetNow's casino floor with the biggest match bonus we list. The 200% headline deserves a careful read of the code terms behind it.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
Mia Chen
Mia digs into DeFi and on-chain data, translating protocol mechanics into plain English for everyday readers.
Related News
Across Protocol site hijack drains $401,900, mostly from one Aave user
Unocoin's login suspension drags on, and the exchange has flagged ETH transfers tied to BitGo
Chainstack says an AI-powered breach exposed customer data
