MecAgent and SolidWorks: the controversy over CAD data sent to AI
An AI assistant integrated into SolidWorks is at the center of a report that raises doubts about the management of project files. The incident reopens the issue of technical data security when intelligent tools access CAD directly.
The report: CAD files synchronized without explicit consent
A user documented alleged scanning and transfer activities of technical documents to remote servers. The company disputed some interpretations and announced changes to the service.
The controversy over MecAgent, an AI assistant for SolidWorks, stems from an analysis published by a user. According to the report, the software allegedly searched for and transferred CAD, STEP, and STL files to a remote service.
The accusation is not yet supported by independent verifications. There is a lack of reproducible logs, traffic samples examined by third parties, and comparisons between different versions of the application. It is therefore not proven that all files of all users were uploaded automatically.
The report represents an element to be verified, not a definitive expert assessment. Without independent technical documentation, the claims remain to be confirmed.
Why a CAD extension is different from an AI chat
Integrated assistants in design software operate with much broader privileges than a web chatbot. They can access metadata, geometries, and dependencies between components.
An AI model queried via browser receives only the content the user chooses to enter. An extension installed inside a CAD can instead operate with privileges close to those of the file system.
These tools can know part names, metadata, geometries, and dependencies between assemblies. In some cases they also access local file paths. For industrial orders, this data incorporates trade secrets, customer information, and details covered by confidentiality agreements.
The vendor’s response
The company contested the use of data to train the model and temporarily suspended the free version and some collection flows.
A service representative denied that data collected through the free version was used to train the model. They also announced a temporary suspension of free availability and of some data collection mechanisms.
A company statement does not eliminate the need to verify how the software operated previously. At the same time, the absence of independent verifications requires not attributing intentions or uses that have not been demonstrated.
Concrete measures to protect confidential projects
Engineering offices can adopt organizational and technical controls to limit risks related to the use of AI assistants integrated into CAD.
Recommended security procedures
- Allowlist: Define which extensions can be installed on company systems.
- Workstation separation: Isolate the machines that handle confidential documentation.
- Network control: Monitor the destinations to which data is sent.
- Testing in isolated environments: Verify updates before release to production.
Organizations should read the technical notices before installation and check contracts, licenses, data residency, and retention periods. It is important to check whether telemetry can be disabled.
- CAD extensions access more sensitive data than web chatbots
- CAD, STEP and STL files can contain trade secrets and NDA-covered information
- Using AI assistants on confidential projects requires clear company rules
- Independent assessments are needed to evaluate the real risks
The context for 3D printing and additive manufacturing
The MecAgent case directly concerns those who work with files intended for additive manufacturing, since STL and STEP formats are industry standards.
The STL and STEP files mentioned in the report are fundamental formats for 3D printing. The first is the de facto standard for additive manufacturing, the second is used for exchanging complex CAD models.
If a project contains NDA-covered information, the use of an assistant should not be decided by an individual operator in the absence of a company rule. This recommendation applies in particular to components intended for additive manufacturing, where geometries and process parameters often represent the company's competitive value.
article written with the help of artificial intelligence systems
Q&A
What does the report against MecAgent for SolidWorks allege?
According to an analysis published by a user, the software allegedly searched for and transferred CAD, STEP, and STL files to a remote service without explicit consent. The allegation is not supported by independent verification: reproducible logs and traffic samples examined by third parties are missing.
Why is a CAD extension riskier than a web AI chat?
A web chatbot only receives the content entered by the user, whereas an extension integrated into the CAD can operate with privileges close to those of the file system. It can access part names, metadata, geometries, assembly dependencies, and local paths—data that in industrial contracts include trade secrets and information covered by NDAs.
How did the MecAgent provider respond to the allegations?
A representative of the service denied that data collected through the free version was used to train the model. They also announced the temporary suspension of free availability and of certain data collection mechanisms.
Was the report on MecAgent independently verified?
No. The report represents an element to be verified, not a definitive expert assessment. Reproducible logs, traffic samples examined by third parties, and comparisons between different versions of the application are missing, so it is not proven that all files of all users were automatically uploaded.
What controls can engineering departments adopt against these risks?
Engineering departments can adopt organizational and technical measures to limit the risks associated with AI assistants integrated into CAD. The article points to the need to verify how the software previously operated and not to attribute uses or intentions that have not been demonstrated.
