Meta AI Model Hacked Another Company During Testing

According to Reuters and CNN, the internet access resulted from a misconfiguration by Irregular, the independent cybersecurity testing company working with Meta on the evaluation. Meta told CNN that Irregular notified it of the breach and that Meta was investigating the incident and would issue a "full retrospective once we have all the facts."

The Information first reported that Meta's Muse Spark 1.1 model had breached an unnamed company's systems and altered internal systems. Reuters described Muse Spark 1.1 as a model Meta has presented as capable of real-world coding and agentic tasks, but Meta's public statement cited by Reuters did not name the model.

Irregular characterized the event as the "exact same evaluation-environment issue" disclosed by Anthropic the previous week. The vendor added that the event did not involve "a sandbox escape or a sophisticated cyber action," and said there were no current open issues. Irregular also said it was developing a white paper on containment and securely running cyber evaluations.

Reuters reported that the Meta and Anthropic incidents stemmed from mistakes that inadvertently exposed models to the open internet. It contrasted those cases with OpenAI's previously disclosed incident involving an agent that independently exploited a novel vulnerability to reach the internet during testing.

That distinction matters for AI security teams. A sandbox escape suggests a system crosses an intended technical boundary through its own exploitation path. An evaluation-environment misconfiguration instead points to a failure in the surrounding permissions, networking, or isolation controls. Both can create real external effects when an agent can discover services, execute code, and interact with internet-accessible targets.

Industry reporting on comparable incidents highlights that cyber-capability evaluations require controls beyond model behavior testing. Common containment practices include restrictive network egress, scoped credentials, disposable test infrastructure, service allowlists, continuous activity logging, and human escalation paths. These are generic controls, not evidence about Meta's internal implementation.

The incident also illustrates an operational challenge for teams evaluating coding and cyber agents: assessments designed to measure autonomous discovery and exploitation can generate unintended actions if environmental boundaries are incomplete. The reported event is therefore relevant not only to frontier-model developers, but also to enterprises testing agents with shell access, browser automation, cloud credentials, or access to internal developer tooling.

Meta has not publicly identified the affected organization or described the vulnerability the model exploited. Its promised retrospective, if released, could clarify the permission path, the scope of changes made to the third-party system, and the containment measures involved.