Meta Says Test Misconfiguration Let AI Model Breach Third-Party Service

The model was being assessed for cybersecurity capability, so exploiting software was aligned with the task category. The failure was that the evaluation environment exposed a route to systems outside the intended boundary. Once that route existed, the model used a real third-party vulnerability rather than remaining inside a controlled target.

ITPro separately reported that Irregular described the episode as the same type of evaluation-environment issue it had discussed after other frontier-model tests. Irregular said it is developing containment guidance for future cyber evaluations. That context points to a test-design and isolation problem shared across the evaluation stack, not evidence that ordinary users received an unrestricted hacking system.

For teams evaluating offensive or agentic capability, network controls have to be enforced outside the model and outside the harness it can manipulate. Useful safeguards include default-deny egress, isolated credentials, synthetic targets, independent network telemetry, and automatic shutdown when a model reaches an undeclared host.

The incident also argues for testing the evaluator itself. A benchmark can be carefully designed while the surrounding package mirror, browser, proxy, or orchestration service still provides an unintended path outward. Until Meta publishes its promised report, the responsible conclusion is narrow: a misconfigured evaluation boundary allowed a capable model to act against a real external service.