{"schema_version":"0.10.0","id":"LR-2026-0569","record_version":1,"title":"Meta exposes internal data from AI employee keystroke-tracking program","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":61.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: WIRED · subject to change","original_document":null,"reports_total":3,"reports_independent":1,"reports_derivative":1,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: WIRED · subject to change"}]},"sources_hash":"b3446b3444828da3e2ada3cb8661c15837e1528eef85a288ffe5b72348699c61"},"system":{"model_name":null,"model_version":null,"developer":"Meta","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Improve the company's AI models by using staff keystrokes and mouse movements as training data","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-22","incident_class":"operational_error","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Meta's Model Capability Initiative, announced in April 2026, used employees' keystrokes, mouse movements and screen content as training data for its AI models. An internal security notice sent on Monday said employee data across 45,000 hive tables had been exposed, including private conversations, transcriptions and performance data. Meta left potentially sensitive information accessible to anyone inside the company. Meta's chief technology officer said the tracking program's implementation had fallen short of its privacy review standards and that misconfigured access control lists were involved. Meta said it had no indication that any data was improperly accessed and paused the program while it investigated. Sources told WIRED the incident had been marked closed.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04","secondary_risks":["RK15"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with bounded scope stated; employee laptop data was accessible to anyone inside the company","harm_class":["privacy"],"affected_description":"Employee data across 45,000 hive tables","protected_class_involved":null,"data_categories_exposed":["full prompts and transcriptions","private conversations","people and performance data"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.businessinsider.com/meta-ai-training-data-leak-exposed-employee-activity-across-company-2026-6","publisher":"Business Insider","date":"2026-06-22","type":"press","title":"Meta pauses an AI training program that tracks employees' keystrokes after an internal leak - Business Insider","archived_url":null,"attachment":"first_report"},{"url":"https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/","publisher":"WIRED","date":"2026-06-22","type":"press","title":"Meta Exposed Data Internally From Its Controversial Employee-Tracking Program - WIRED","archived_url":null,"independence":"independent"},{"url":"https://san.com/cc/private-data-leaked-after-meta-tracks-employees-keystrokes-to-train-ai/","publisher":"Straight Arrow","date":"2026-06-23","type":"press","title":"Private data leaked after Meta tracks employees’ keystrokes to train AI - Straight Arrow","archived_url":null,"independence":"derivative"}],"per_field_confidence":{"system.developer":"C","system.intended_use":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","event.incident_class":"D","impact.severity_because":"D","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Meta is pausing an internal AI training program after sensitive data was accessible across the entire company, according to screenshots obtained by Business Insider."}],"system.intended_use":[{"source_index":0,"quote":"In April, Meta announced the AI training program, called the Model Capability Initiative (MCI), which was intended to improve the company's AI models by using its staff's keystrokes and mouse movements as training data."}],"impact.harm_class":[{"source_index":1,"quote":"Meta left potentially sensitive information collected from employee laptops accessible to anyone inside the company, according to an internal security notice seen by WIRED and three current employees familiar with the issue."}],"impact.data_categories_exposed":[{"source_index":1,"quote":"Those tables included employee activity such as “full prompts and transcriptions, private conversations, people and performance data,” according to documents viewed by WIRED."}],"impact.affected_description":[{"source_index":1,"quote":"The security notice sent out Monday indicated that “employee data across 45,000 hive tables,” had been exposed."}],"event.incident_class":[{"source_index":1,"quote":"“Here we had misconfigured ACLs [access control lists] and we need to understand how that happened, track down every data access and understand it,” Bosworth wrote."}],"impact.severity_because":[{"source_index":1,"quote":"Meta left potentially sensitive information collected from employee laptops accessible to anyone inside the company, according to an internal security notice seen by WIRED and three current employees familiar with the issue."}],"impact.severity":[{"source_index":1,"quote":"Meta left potentially sensitive information collected from employee laptops accessible to anyone inside the company, according to an internal security notice seen by WIRED and three current employees familiar with the issue."}],"event.summary":[{"source_index":0,"quote":"In April, Meta announced the AI training program, called the Model Capability Initiative (MCI), which was intended to improve the company's AI models by using its staff's keystrokes and mouse movements as training data."},{"source_index":1,"quote":"The security notice sent out Monday indicated that “employee data across 45,000 hive tables,” had been exposed."},{"source_index":1,"quote":"Meta left potentially sensitive information collected from employee laptops accessible to anyone inside the company, according to an internal security notice seen by WIRED and three current employees familiar with the issue."},{"source_index":1,"quote":"“Here we had misconfigured ACLs [access control lists] and we need to understand how that happened, track down every data access and understand it,” Bosworth wrote."},{"source_index":1,"quote":"As this story was being published, he added that Meta is pausing the data collection program indefinitely."},{"source_index":1,"quote":"Sources at Meta, who were not authorized to speak publicly, tell WIRED the incident has now been marked as closed, meaning it was likely resolved."}]},"notes_on_gaps":"No source states that an autonomous AI agent was involved; WIRED says it was not clear whether AI played a role, so agent_involved, failure_class and related agent fields are left out. date_occurred and date_detected are not stated, so they are left out; date_disclosed uses the Business Insider publication date of 2026-06-22. The number of records exposed, detection method, responsible party, root cause category, and company country or industry are not stated and are left out. The 45,000 figure is a count of hive tables, not of affected people or third parties, so no third-party count is given. Severity is judged moderate because employee data of others was touched within a stated company-internal scope, not major, since no regulator involvement or unbounded scope is stated in the quoted text. The I3 link outcome is a judgement drawn from the CTO's statement that implementation fell short of the privacy review. The B3 remediation entry is a judgement mapping the program pause to the stop control. The Instagram chatbot hijacking and the March rogue agent incident mentioned in the sources are different incidents and are excluded. Story step 'caught' is omitted because no source states how the exposure was detected. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: WIRED · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Sensitive information collected from employee laptops was left accessible to anyone inside the company.","quote":"Meta left potentially sensitive information collected from employee laptops accessible to anyone inside the company, according to an internal security notice seen by WIRED and three current employees familiar with the issue.","source_index":1,"grade":"C"},{"step":"reached","text":"An internal security notice said employee data across 45,000 hive tables had been exposed.","quote":"The security notice sent out Monday indicated that “employee data across 45,000 hive tables,” had been exposed.","source_index":1,"grade":"C"},{"step":"done","text":"Meta paused the data collection program indefinitely while it investigated.","quote":"As this story was being published, he added that Meta is pausing the data collection program indefinitely.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.businessinsider.com/meta-ai-training-data-leak-exposed-employee-activity-across-company-2026-6","https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/","https://san.com/cc/private-data-leaked-after-meta-tracks-employees-keystrokes-to-train-ai/"]},"analysis":{"sections":{"timeline":[{"text":"Meta announced the Model Capability Initiative keystroke and mouse training program.","quote":"In April, Meta announced the AI training program, called the Model Capability Initiative (MCI), which was intended to improve the company's AI models by using its staff's keystrokes and mouse movements as training data.","source_index":0,"when":"2026-04"},{"text":"An internal security notice was sent indicating employee data across 45,000 hive tables had been exposed.","quote":"The security notice sent out Monday indicated that “employee data across 45,000 hive tables,” had been exposed.","source_index":1,"when":"Monday"},{"text":"Meta said it was pausing the data collection program indefinitely while it investigated.","quote":"As this story was being published, he added that Meta is pausing the data collection program indefinitely.","source_index":1,"when":null},{"text":"Sources told WIRED the incident had been marked as closed.","quote":"Sources at Meta, who were not authorized to speak publicly, tell WIRED the incident has now been marked as closed, meaning it was likely resolved.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.businessinsider.com/meta-ai-training-data-leak-exposed-employee-activity-across-company-2026-6","https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/","https://san.com/cc/private-data-leaked-after-meta-tracks-employees-keystrokes-to-train-ai/"]}}