'I am incensed': Meta's AI program tracked employees' keystrokes and private conversations — then leaked the data company-wide. Now it’s paused

On a scale of zero to five — with zero being the most serious — this incident has been classified as SEV 2.

‘We’re pausing it while we investigate’

Meta introduced its AI training program — the Model Capability Initiative (MCI) — back in April. The program, which was made mandatory for most of Meta’s staff, was intended to use employees’ mouse movements and keystrokes as training data to improve Meta’s AI models.

At the time, the company made it clear the program would be tracking employees and their actions online.

“For agents to understand how people actually complete everyday tasks using computers, we need to train our models on real examples,” stated an internal announcement about MCI, which Business Insider obtained.

And while the company was transparent with its intentions, employees were quick to voice their displeasure. Many reportedly reacted with the angry-face emoji, while the top-rated comment in response to the MCI announcement was, “This makes me super uncomfortable. How do we opt out?”

An already frustrated staff was then angered even further when the program’s data leaked and was made accessible to the entire company.

“I am incensed,” wrote one employee in an internal group, according to Business Insider. “I don’t see any evidence of malicious access, but the fact that this data wasn’t locked down as originally promised is super frustrating.”

Moneywise reached out to Meta for comment and received the below statement.

“We have carefully designed this program with privacy safeguards and while we have no indication at this time that any data was improperly accessed by Meta employees, we’re pausing it while we investigate,” the spokesperson told Moneywise.

Another controversy for Meta

This leak, and the uproar it’s created, is yet another controversial security incident for Meta in 2026.

In early June, hackers reportedly tricked Instagram’s AI support tools into providing them with access to random users’ accounts. The hackers were then able to change the passwords for the breached accounts by faking location data and prompting the AI to change the email addresses attached to them.