Kimi Work secretly attaches raw agent sessions to feedback reports
Kimi Work attaches raw agent sessions to feedback reports
A reverse engineer discovered that Kimi Work's desktop app includes the five most recent agent sessions with every feedback report, without any user notification. These sessions can contain sensitive information, and users are unknowingly sending them to Kimi. The researcher notified Kimi and is warning others.
These sessions could have ANYTHING in them, and you have no idea you're sending it all to Kimi.
- wren6991
> Why It Matters
Thanks Claude, the analysis looks to be load-bearing, and dare I say the gun may be smoking. This sharpens the framing considerably.
Honest caveat: most AI providers' privacy policies have an explicit carve-out for feedback. (Uploading the last 5 sessions wholesale is pretty wild though.)
- KronisLV
> when you send a feedback report, it attaches the 5 latest sessions to the report with no notice or heads up or anything.
Not informing the user of that feels wrong, and even then you'd probably want like a dropdown to choose between just the current session vs the last 5 if that much context is really needed, with either Off or 1 being the default.
Claude Code has a clear disclaimer, probably exactly how it should be done:
> Submitting this report will send the entire current conversation to Anthropic for future improvements to our models. Learn More
- bbg2401
You’ve submitted nearly 100 AI written articles from this source in the past 40 days…