Kimi Work Feedback Reports Upload Five Recent Agent Sessions Without Clear Disclosure
Summary
A developer’s analysis found that Kimi Work for Windows v3.1.5 uploads five recent agent sessions with feedback reports, potentially exposing raw execution data without clear disclosure or an opt-out. No traditional security vulnerability is established.
Key points
- According to the developer’s analysis, submitting feedback in Kimi Work for Windows v3.1.5 automatically uploads the five most recently updated agent sessions, not only the session related to the report.
- The feedback interface does not clearly disclose these attachments or offer session previews, individual selection, or a way to disable session uploads.
- Session records can include model requests, tool definitions, MCP metadata, and other raw execution data.
- The article estimates that five sessions could contribute up to about 40 MB of data, in addition to diagnostic logs.
- Filtering removes some large data blocks and truncates long strings, but the article says it does not actively detect passwords or other sensitive plain-text data.
- Session uploads occur when a user submits feedback; the article reports no evidence of a traditional security vulnerability.
Article Details
- Event Type
- Privacy and data-disclosure issue in Kimi Work for Windows v3.1.5 feedback submissions
- Impact
- Submitting feedback automatically uploads the five most recently updated agent sessions alongside diagnostic logs, without clearly disclosing the attachments or offering individual opt-out controls. Session data may include raw execution records, model requests, tool definitions, MCP metadata, and sensitive plain-text information. The article reports no evidence of a traditional security vulnerability.