Your go-to hub for Expert Insights,
Publications, and Resources on
data privacy and compliance

Scale AI, the data‑labeling startup recently backed by a $14.3 billion investment from Meta, has come under scrutiny after it reportedly stored confidential work in publicly accessible Google Docs. According to a Business Insider review, sensitive materials from high-profile clients like Meta, Google, and Elon Musk’s xAI were left unsecured in shared documents.

The company’s reliance on simple Google Docs to coordinate work among its 240,000‑strong contractor workforce poses serious cybersecurity risks, experts warn. Internal documents marked “confidential” included details on Google’s Bard (now Gemini), xAI’s "Project Xylophone," and Meta’s chatbot training data, some even editable by anyone with the link.

Beyond proprietary data, contractor personal information was exposed: email addresses, performance reviews, payment records, and even lists flagging “cheating” behavior were publicly accessible. Workers described the system as “incredibly janky” and said that identifying clients was often trivial despite anonymization efforts.

Cybersecurity specialists caution that such practices invite social engineering and malware risks. “Of course it’s dangerous,” said cybersecurity lecturer Joseph Steinberg, citing potential for impersonation and embedded malicious links in editable files. Another expert suggested the company should shift to invite-only access controls rather than relying on unmonitored links.

Scale AI confirms it has disabled public sharing on internal systems and launched an investigation.

The timing of these revelations shortly after Meta’s record-breaking investment has prompted concern from other clients. OpenAI, Google, and xAI have reportedly paused new and ongoing projects pending reassurances on data safety.

This high-profile oversight raises questions about Scale AI’s readiness to manage highly confidential projects at scale. As trust becomes a pivotal asset, the startup faces growing pressure to strengthen its data protection measures or risk losing critical partnerships.

Reference Link: Business Insider