A privacy issue in Moonshot AI’s Kimi Work desktop client causes feedback submissions to automatically upload the five most recently updated agent sessions, along with diagnostic logs, without clearly disclosing this to users. The uploaded session data can include raw execution records and other sensitive information from unrelated work, highlighting a lack of transparency in the feedback process. #MoonshotAI #KimiWork #Daimon
Keypoints
- Kimi Work for Windows v3.1.5 automatically uploads the five most recent agent sessions when feedback is submitted.
- The feedback interface does not disclose the session attachments or provide an option to opt out individually.
- Uploaded sessions may contain raw execution data, including model requests, tool definitions, and MCP metadata.
- Up to about 40MB of session data could be sent along with the client’s diagnostic logs.
- The main concern is lack of user disclosure and control, not a traditional security vulnerability.
Read More: https://securityonline.info/kimi-work-feedback-agent-session-privacy/