Meta's CTO stated that employee-tracking information ended up 'in places it shouldn't have.'

      Meta's chief technology officer has provided the most comprehensive explanation to date regarding the incident that led the company to pause its most controversial AI project, the keystroke-logging initiative known as the Model Capability Initiative. Andrew Bosworth stated that a researcher had placed sensitive employee data in an inappropriate location, although he emphasized that there was no external breach.

      In an interview with The Atlantic's CEO Nicholas Thompson, released on Wednesday and recorded in late June, Bosworth referred to the data as “quite secure,” accessible to only a small number of individuals. He noted that the issue originated internally.

      This development is the latest chapter in an ongoing situation, which has involved the installation of tracking software on employee laptops and a temporary halt across the organization. “One of the researchers who was working downstream with that data had put it in a place it wasn’t supposed to go, and there was no breach here,” Bosworth explained to Thompson. He added that the information, in a altered form, had “landed someplace that it shouldn’t have landed internally.” Bosworth indicated that Meta did not suspect any malicious intent.

      The company decided to “lock the whole thing down” while investigating what occurred. Meta had suspended the program in June following a leak that exposed sensitive employee data within the company, as reported by Business Insider through screenshots.

      Launched in April, the Model Capability Initiative involved installing software on most of Meta's U.S. employees' devices to record their keystrokes and mouse movements, which are essential for training the company’s AI models. Meta faced significant backlash over its stance that employees could not opt out.

      “We designed this program with privacy protections in mind, and while we currently have no evidence that any data was improperly accessed by Meta employees, we are pausing it while we conduct our investigation,” a spokesperson for Meta told Business Insider in June.

      The company chose not to provide further comments for this follow-up.

      The initiative was introduced at a particularly challenging time for employees. Bosworth himself noted in an internal meeting that employee morale was “probably one of the worst it’s ever been” in Meta’s twenty-year history, with layoffs and a significant shift toward AI creating unease among the workforce.

      Opposition to the tracking initiative was swift and well-organized, with over 1,600 employees signing a petition against the software. One office reportedly referred to it as the “Employee Data Extraction Factory.”

      Privacy attorneys warned that the tool could collect European employee data in ways that might violate GDPR regulations.

      During the interview, Bosworth also identified another reason for the project's setbacks, citing scientific rather than political issues. He indicated that the program was collecting too much of the same data, while AI models require diversity. “Variance is far more important than a high volume of the same thing that gets collapsed into one example,” he conveyed to Thompson.

      This realization led Meta to expand the opt-out options that had previously been limited. “That was why, a couple of weeks after we initially launched it, we added expanded opt-outs for people who didn’t want to participate,” Bosworth revealed. “A pause, infinite pause. Whenever you don’t want to have it, just press pause.” This represents a shift from the original no-opt-out policy, which Meta had previously tried to mitigate with brief 30-minute breaks.

      It remains unclear if the program will return in its initial form. Bosworth framed the pause as a precaution rather than a withdrawal, but the situation has provided critics—both within the company and externally—with a case study illustrating how surveillance designed to enhance AI can inadvertently impact the workforce it was intended to assess.

      For the time being, the keystroke logging initiative is inactive, investigations are ongoing, and the researcher involved in the incident has not been publicly identified. The CTO left unanswered the more complex question of what will happen to the data that has already been collected.