Cases › operational mistake › LR-2026-0569
Meta exposes internal data from AI employee keystroke-tracking program
Preliminary Why: 1 report: WIRED · subject to change · 1 independent report
Status: action reported, no fix
No source states: loss or records, agent tool, could do, deployer, industry.
Severity moderate: Test: data of others touched with bounded scope stated; employee laptop data was accessible to anyone inside the company
Meta's Model Capability Initiative, announced in April 2026, used employees' keystrokes, mouse movements and screen content as training data for its AI models. An internal security notice sent on Monday said employee data across 45,000 hive tables had been exposed, including private conversations, transcriptions and performance data. Meta left potentially sensitive information accessible to anyone inside the company. Meta's chief technology officer said the tracking program's implementation had fallen short of its privacy review standards and that misconfigured access control lists were involved. Meta said it had no indication that any data was improperly accessed and paused the program while it investigated. Sources told WIRED the incident had been marked closed.
What happened
What was done
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
Harness ApplicationSensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs
Similar incidents
Evidence
No source states: what the AI was doing, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 4 items from the primary sources
What happened, in order
- 2026-04 Meta announced the Model Capability Initiative keystroke and mouse training program.
Not dated in the sources:
- An internal security notice was sent indicating employee data across 45,000 hive tables had been exposed.
- Meta said it was pausing the data collection program indefinitely while it investigated.
- Sources told WIRED the incident had been marked as closed.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The Instagram chatbot hijacking and the March rogue agent incident mentioned in the sources are different incidents and are excluded.
LR-2026-0569 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON