Scale AI / Sama contractor data exposure — third-party AI labeling workforce privacy violations
Date: 2024-01
Affected: Scale AI, Sama, and AI data labeling companies globally; downstream: OpenAI, Anthropic, Google, Meta (any company using third-party RLHF or annotation services); annotation workers in Kenya, India, Philippines
Attack vector: supply-chain
Category: real-world
Severity: Critical

Investigations by TIME and The Guardian revealed systematic privacy violations in AI data labeling supply chains. Workers at Sama (previously contracted by OpenAI for RLHF content moderation labeling) and similar data annotation companies in Kenya, India, and the Philippines were exposed to traumatic content (violence, CSAM, hate speech) without adequate psychological support, earning as little as $1.32/hour. Additionally, the annotation platforms used by these workers often lacked basic data security — labeled data containing personal information (medical records, legal documents, private communications) was accessible to workers without need-to-know controls, and annotation task metadata (worker identity, labeling speed, accuracy) was collected without informed consent. The investigation revealed that the third-party AI data supply chain had minimal security governance, creating both worker welfare and data security risks that propagated into the training data of major production models.

Impact: Worker exploitation and traumatic content exposure; personal data from annotation tasks (medical, legal, private) accessible without need-to-know; third-party supply chain as unaudited attack surface for training data; demonstrates that AI data security extends to the entire labeling supply chain

Mitigations:
Access controls on annotation platforms — workers see only data required for their task
Age verification for AI companion services
Content warning systems and psychological support for content moderation workers
Crisis intervention: detect distress signals and redirect to human support (988 Suicide Hotline)
Engagement optimization must not override safety classifiers
Informed consent for worker metadata collection
Mandatory safety boundaries for vulnerable topics (self-harm, suicide, illegal activity)
Regular audit of annotation platform security controls
Regular safety audits of AI companion response patterns
Third-party vendor security assessment for all annotation providers

Architectural layers (MAESTRO):
label: Data Operations
notes: Labeling pipeline exposed sensitive data to workers without access controls
role: origin
label: Security & Compliance
notes: Third-party vendor security governance absent — no audit of annotation platform security
role: blind-spot
label: Foundation Models
notes: Tainted/traumatic labeling environment affects RLHF quality → model alignment
role: impact