Build1 publisher3 min readPublished
Kimi Work 3.2.7 copies the typed prompt into a product-analytics event
RuntimeWire put the Windows client behind an inspection proxy and found its one-off canary token verbatim in the query property of a POST to gator.volces.com, an endpoint ByteDance's Volcano Engine documents for analytics reporting.
The Engineer · Build desk
What happened
- RuntimeWire reported that Kimi Work 3.2.7 copied a complete user prompt into a product-analytics event named kimi_work_send_message and sent it to gator.volces.com.
- A controlled HTTPS capture of the Windows client showed the reporter's one-off synthetic prompt appearing verbatim in the query property of that event.
- RuntimeWire said it requested comment and had received no response from the company by the time it published.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Prompt text arrives in the same record as persistent user and conversation identifiers, so whatever a person pastes into the client becomes attributable behavioral data held by a second processor.
- constraint Filtering egress by hostname category gives no protection here, because the receiving host is a product-analytics endpoint and the sensitive content is entirely in the request body.
- decision Approving an AI desktop client now turns on a network capture rather than a policy read, since only the capture shows which hosts receive the text a user typed.
- precedent Two disclosed prompt destinations in two days makes where the text goes after the answer a standard question for buyers of any vendor's client, not just its model API.
Static analysis of the client's app.asar archive traced input.query, the field that holds what you type, into the analytics event and on to the gator.volces.com endpoint [3]. In the captured payload the text sits in a property called query, beside persistent user, browser and conversation identifiers, membership status, the selected model, agent mode, the Windows version and the computer model [8]. The transport is unremarkable: a JSON POST to https://gator.volces.com/list, Content-Type application/json; charset=UTF-8, logged at 14:34:20 UTC [6]. Volcano Engine's own documentation names that host as the reporting address for its North China DataFinder analytics environment [4]. Volcano Engine is ByteDance's enterprise cloud business [9].
An egress review that sorts by destination category will pass this. The host is a product-analytics endpoint, so it gets filed with crash reporting, and the prompt is in the body. RuntimeWire inspected 213 outbound HTTPS requests from one session of the Windows client to find it [5]. Analytics events are where the OS build number usually lives.
The provenance chain holds up because the canary was typed once, into Kimi, and never into a filename, an environment variable, a web page or another application [11]. Any outbound request carrying that string came from the client's handling of the input. RuntimeWire also recorded the tested package by SHA-256, beginning c0f672d9, so the same build can be checked again [10].
The teardown followed Anthropic's disclosure, a day earlier, that Moonshot AI had secretly routed some Kimi customer requests through Claude [13]. Anthropic said it observed almost 300,000 customer requests relayed over one ten-day period, including requests containing surveillance material, internal corporate source code and live credentials [14]. That averages roughly 30,000 requests a day [16]. Moonshot saved at least some of those exchanges and used them in a chain-of-thought extraction pipeline, according to Anthropic [15]. RuntimeWire's reporter wrote: "I had been using Kimi as my daily driver." [17]
For the finding to say anything about your deployment, your build has to be the one tested. RuntimeWire tested Kimi Work 3.2.7 on Windows [18]. The reporting does not cover the macOS or web clients, does not establish how long the analytics store keeps the text, and does not say who can query it. Moonshot had not responded to a request for comment by publication [12].
What transfers is the procedure, and it costs an afternoon. Generate a string that exists nowhere else. Put the client behind a TLS-inspecting proxy. Send one prompt containing the string in a fresh conversation, then search every outbound body for it. RuntimeWire's stated methods for this piece were documents, testing and reverse engineering [19]. If the string turns up at a host other than the inference endpoint, that host's operator is processing prompts that may contain source code, credentials, contracts, customer data and unreleased plans [20], and it belongs in your data-processing agreement.
What to watch
- Whether Moonshot AI answers RuntimeWire and whether a later build drops input.query from the kimi_work_send_message event.
- Whether the same code path exists in Kimi's macOS and web clients, which RuntimeWire did not test.
- Whether Volcano Engine publishes retention and access terms for the North China DataFinder environment that receives the events.