Meta Leaked Internal Keystroke Data From Its Employee-Tracking AI Program

Meta gave employees access to each other's keystroke data collected through an internal tracking program, according to a report from WIRED. The program was already controversial inside the company because it involves recording workers' keystrokes to train AI models. The accidental internal exposure adds a significant wrinkle to a surveillance initiative that employees had already pushed back on before this incident came to light.

What happened

Meta accidentally exposed keystroke data collected from its own employees to other workers inside the company, according to WIRED. The data came from an internal program designed to record employee keystrokes for the purpose of training AI models.

This was not an external breach. The exposure happened internally, meaning Meta employees could see data that had been captured from their colleagues through this tracking system.

Why it matters

Before this incident, employees had already voiced concerns about the program itself. Collecting keystroke-level data from workers is a significant form of workplace surveillance. Keystrokes can capture everything a person types, including passwords, personal messages, and sensitive work communications.

Using that data to train AI models raises its own set of questions. What exactly is being fed into the models? How long is the data retained? Who can access it? This accidental exposure suggests the access controls around that data were not tight enough to prevent internal leaks, let alone guarantee security against outside threats.

For anyone running a business that uses AI tools built on workforce data, this is a useful reminder that the data pipeline matters just as much as the model output. Poorly governed training data creates liability, erodes employee trust, and in this case, became a news story.

Our take

The core problem here is not just the accidental exposure. It is the underlying design choice: capturing granular employee behavior data and piping it into AI training without airtight controls in place first.

At Lumien, we work with AI tools regularly, and one thing that is easy to overlook is how your data is used once it leaves your system or your team. Meta is a company with enormous engineering resources. If they shipped a program like this with access control gaps, smaller organizations adopting similar monitoring tools should be asking much harder questions before they sign up.

There is also a trust cost here that does not show up in a dashboard. Employees who already objected to being tracked now know their data was handled carelessly. That is a morale and retention issue, not just a compliance one.

A few things worth watching as this develops:

• Whether Meta discloses the scope of the exposure (how many employees, how much data, for how long).
• Whether regulators in the EU or California take an interest, given strict rules around employee data and automated decision-making.
• How Meta responds to internal pressure about the program’s future.

What to do about it

If your business uses any tool that collects employee activity data, whether for productivity monitoring or AI training, do a quick audit of who has access to that data and under what conditions. Check whether your vendor has published a clear data retention and access policy. If they have not, ask. The question is not whether AI benefits from behavioral data. It is whether the governance around that data is solid enough to justify the risk.

Source: WIRED · AI