In April 2026, Meta quietly launched an internal project called "Model Capabilities Initiative" (MCI) at its US offices. The project trained AI systems to operate computer software like humans by recording employees' keyboard inputs, mouse movements, and screen shots. Meta executives' logic was simple: by observing how the best employees work, they could obtain the best AI training data.

45,000 pieces of data leaked, employee privacy "naked"

Yet, just two months later, the project backfired in a near-sarcastic way. Due to an access control configuration error, about 45,000 data tables containing employees' private data were exposed to anyone within the company who might find them. The leaked content not only included complete AI prompts but also private conversations, personnel performance data, and even individual employees' personal tax and medical information. A former employee described the incident as "a mess" and revealed that employees had long anticipated a leak, but the leadership ignored warnings about privacy and security.

From monitoring to replacement, employees become AI training "consumables"

Long before the security vulnerability was exposed, more than 1,600 Meta employees signed a petition demanding the stop of MCI. The core demands of the employees focused on privacy, security, and choice: no one wanted every keystroke they made to be recorded; storing such a large amount of sensitive behavioral data in a centralized manner was itself a huge leakage risk; moreover, when the project was launched, employees had no right to opt out. An employee wrote angrily on an internal forum: "We were told these data would be protected, but that's not true."

The timeline of the incident shows that the problem was first noticed by a Meta engineer on June 18th and reported. Stephane Kasriel, the AI research vice president, said the vulnerability was fixed within four hours, but the initial fix did not truly resolve the issue, and data access permissions were found to have gaps again. Kasriel announced the indefinite suspension of MCI on June 22nd and stated that it would be reactivated only when there was confidence in the effectiveness of data protection controls. He also hinted that the company had already "collected enough data to assess the long-term value of the tool," which means the project may face complete termination.

Legal risks also loom over Meta. Experts pointed out that the MCI project may violate the European GDPR regulations, especially when collecting employees' behavioral data without sufficient consent. In addition, Meta is still subject to a consent decree from the U.S. FTC that lasts until 2040. If the FTC determines that this security incident violates the terms, Meta will face new regulatory penalties. Analysts described Meta's data protection measures as "as thin as paper."

The MCI incident reveals a deeper issue: when the data needed for AI training comes from within the company, employees simultaneously become the "raw material" for training data and the "bearer" of privacy risks. For a company whose main business is collecting and monetizing user data, failing to protect its own employees' data security is more damaging to internal trust than any external privacy scandal. As AI agents are increasingly deployed in enterprises, employee behavior monitoring is becoming a rapidly growing gray area, and Meta's case has sounded a warning for the entire industry.