Scale AI has now locked down project materials for clients like Meta and xAI following a Business Insider report that thousands of sensitive files were stored as Google Docs that were publicly accessible with links.
The company — which uses human gig workers to improve Big Tech's latest AI models and is receiving a $14 billion investment from Meta — scrambled to secure its files this week, according to four Scale contractors who asked to remain anonymous because of the sensitivity of the matter.
That left teams of workers temporarily unable to open training documents. Thousands of Scale AI files previously reviewed by BI that had been public are now private.
"What is happening is a knee-jerk reaction to being in the headlines," Stephanie Kurtz, a regional director with cybersecurity firm Trace3, told BI. She said that locking down the documents and inviting the correct users "should have been done in the first place."
By Wednesday, teams had resolved many of the document access issues, one worker said. Another said contributors were now being granted individual access to documents.
ScaleAI has said it is investigating security gaps, following BI's initial reporting. The company told BI on Monday that it was conducting a thorough investigation and had disabled any user's ability to publicly share documents from Scale's systems.
It reiterated that statement for this article and did not comment further on specific changes it has made to Scale AI's document security.
"We take data security seriously," a Scale AI spokesperson said. "We remain committed to robust technical and policy safeguards to protect confidential information and are always working to strengthen our practices."
BI first flagged the public Google Docs to Scale AI for a June 13 article about how they showed Google using ChatGPT to improve its AI chatbot. BI also encountered public Scale AI documents during prior reports about how xAI and Meta were training their latest AI models.
At least 85 individual Google Docs containing thousands of pages remained up and fully accessible until BI published an article on Tuesday that focused on the security issue this practice created.
BI reported that Scale AI had left open thousands of project documents tied to its work with clients, including Google and Meta, allowing anyone with a link to access them. Several documents also contained contact information for numerous Scale AI workers, some of whom were surprised to discover their details were accessible when BI contacted them.
Scale AI has routinely used public Google Docs to track work for high-profile customers, as it's an efficient way to share information with its more than 240,000 contractors. BI found that those documents often contain sensitive information about how workers train AI models for Big Tech clients. Multiple AI training documents reviewed by BI were labeled "confidential" and accessible to anyone with the link.
After Scale AI's lockdown, one contractor described a "site-wide" problem accessing project materials on Tuesday. Another said that many teams' work had ground to a halt due to the new restrictions, with one even losing access in the middle of a critical presentation.
"We are basically chilling out here," the contractor said.
There's no indication that Scale AI had suffered a data breach. Cybersecurity experts told BI that the practice could leave the company vulnerable to hacking.
The document lockout was another bit of whiplash for Scale AI contractors, who were affected by Meta's mega-investment and its decision to hire CEO Alexandr Wang, for its new AI superintelligence group.
After the deal announcement, Google halted several of its projects with Scale AI. OpenAI and Elon Musk's xAI have also paused projects with Scale, BI previously reported, and one smaller investor said they were selling their remaining stake in the startup.
Many contractors discovered that some of their projects had been paused. While Scale AI sent its contractors a memo announcing the Meta investment, many workers said they were left in the dark about clients pausing projects, mostly without prior warning.
"We have robust protections in place to protect customer data, and when it comes to sharing settings, our default is to keep a company's files restricted from sharing outside the organization," a Google spokesperson said.
Changing that default setting is a "business choice that a customer explicitly makes," the spokesperson said.
"We encourage customers to stick with the default sharing protections wherever possible, and closely manage all permissions they grant on sensitive company data," the spokesperson added.
Meta declined to comment.
Have a tip? Contact Charles Rollet via email at crollet@businessinsider.com or Signal and WhatsApp at 628-282-2811. Contact Hugh Langley via email at hlangley@bjinnox.com or on Signal at hughlangley.01. Use a personal email address and a nonwork device; here's our guide to sharing information securely.
