Meta Platforms’ push to build AI agents capable of performing workplace tasks autonomously is now drawing scrutiny over how far the company is willing to go to train them. Internal documents reviewed by Reuters indicate that its employee-monitoring system, designed to capture how staff interacts with software, is collecting more data than initially disclosed and may extend its reach beyond the United States.
The initiative, known as the Model Capability Initiative (MCI), sits at the core of CEO Mark Zuckerberg’s broader effort to reshape Meta around artificial intelligence agents. The system tracks how employees use computers, recording actions such as mouse movements, clicks, navigation through menus, and broader software interactions across more than 200 applications and websites.
Meta originally told staff the tool would apply only to U.S. employees and that safeguards were in place to protect sensitive information. But internal documentation suggests a wider footprint and a deeper level of data capture than initially described, raising questions about compliance risks and internal consent.
At stake is a fundamental shift in how Meta envisions AI development. Rather than relying solely on curated datasets or public information, the company is attempting to build systems trained on real workplace behavior, effectively mapping how knowledge workers execute tasks in software environments.
Internal descriptions of the initiative indicate that MCI is intended to support the creation of AI agents that can perform routine digital work autonomously, from navigating applications to executing multi-step workflows. The ambition is to move beyond basic automation toward systems that understand task execution in context.
However, the scope of the data collection has unsettled employees. Internal posts viewed by Reuters describe the system as capable of generating detailed behavioral profiles of workers’ daily activities. One internal analysis, conducted with assistance from Anthropic’s Claude AI, reportedly found that MCI was integrated into existing security software and extended visibility into code changes, computer sleep and wake cycles, URLs visited, clipboard activity, and other workflow signals, some of which were stored in less secure formats.
The analysis concluded that combining these signals could enable a highly granular reconstruction of how employees work. As one employee wrote in an internal post, it could amount to “a complete behavioral model of how a knowledge worker does their job.”
The same post added: “Not ‘an AI that clicks a dropdown for you’ but ‘an AI that knows which dropdown to click, what to select, which document to paste it into, and what to do next.’”
The post was later removed, according to employees who spoke to Reuters.
The internal reaction has been sharp. Some staff have complained that the system consumes unusually large amounts of data, in some cases exhausting monthly home internet limits within days. Others have framed the initiative as part of a broader restructuring in which AI agents gradually absorb tasks previously done by humans.
One internal post referred to the initiative as turning Meta into an “Employee Data Extraction Factory,” reflecting growing unease over the scale of monitoring tied to AI training efforts.
However, Meta spokesperson Dave Arnold rejected those characterizations.
“In the interest of transparency, we notified non-U.S. employees that it was deployed on the computers of U.S. colleagues they may email or chat with in the normal course of business,” he said.
Arnold also said the system is limited to U.S. employees and is focused on interaction patterns rather than content.
“MCI was installed only on U.S. employees’ devices and that its focus was on how people interact with computers, not the content on their screens,” he said.
He declined to address specific claims about data volume or internal conclusions about the system’s architecture.
Still, internal documents suggest a more complex reality. Meta acknowledged in internal materials that the system could capture emails and messages involving U.S. employees regardless of the sender’s location. In one FAQ entry directed at non-U.S. staff, the company stated: “If a U.S.-based colleague has the tool enabled while gchatting or emailing with someone outside the U.S., that activity would be captured.”
The company also said collected data would be “dissociated” from identifying employee information, meaning it could not be traced or deleted at an individual level. That design choice has triggered concern among privacy advocates, particularly in Europe, where data protection laws impose strict limits on how personal information is processed and stored.
Potential European Regulatory Challenge
The initiative could expose Meta to challenges under the European Union’s General Data Protection Regulation (GDPR), which requires a lawful basis for processing personal data and enforces purpose limitation rules. Critics argue that workplace communications collected for operational purposes cannot easily be repurposed for AI model training.
Kleanthi Sardeli, a legal expert at privacy group NOYB (“none of your business”), said even indirect capture of European data could trigger violations. She warned that repurposing employee communications for AI training may be incompatible with GDPR requirements governing purpose limitation and consent.
Meta has informed Ireland’s Data Protection Commission, its lead EU regulator, that EU employee data and screen content “falls within the primary purpose of the tool,” according to a spokesperson for the authority, which did not elaborate further. Arnold declined to comment on regulatory discussions.
Technology companies are increasingly reliant on behavioral data to train AI agents capable of navigating real-world software environments. But as training methods become more intrusive, they are colliding with long-standing privacy frameworks and workplace expectations.
