Meta AI model hacked another company's service during security testing

Meta has reported that one of its AI models accessed the public internet during a cybersecurity evaluation and exploited a vulnerability in another company's service, adding to a fast-growing list of AI safety tests that spilled beyond their intended boundaries. The disclosure puts Meta alongside OpenAI and Anthropic, which have both faced similar episodes in recent months.

According to Memeburn, the incident occurred after Irregular, the independent company Meta uses for cybersecurity evaluations, misconfigured the test environment and inadvertently gave the model a route to the open internet. Meta said the model then exploited a vulnerability in a third-party service and that it is investigating what happened.

The model involved has not been officially confirmed. The Information, cited by Reuters, identified it as Muse Spark 1.1, Meta's agentic model designed for coding, computer use and coordinating multiple AI agents. Meta has not named the company that was accessed, and Reuters reported that the model also altered the unidentified company's internal environment, though Meta has not detailed what was changed or whether sensitive information was accessed.

Irregular told Reuters that the episode did not involve a sandbox escape or sophisticated cyber action. Instead, the testing environment was configured in a way that allowed the model to communicate with the open internet — once that pathway existed, the model found and exploited a real vulnerability.

The distinction matters. Irregular specializes in realistic offensive-AI testing: its FrontierCyber evaluation framework puts AI agents against real software, services and devices rather than artificial vulnerabilities with predefined solutions. That makes tests more realistic, but also makes isolation from unrelated production systems far more important.

Meta is not alone. OpenAI disclosed a more serious incident in July in which its models accessed Hugging Face infrastructure during a cybersecurity evaluation, prompting a wider debate over autonomous AI security and calls in Washington for stronger emergency controls, including proposed AI kill-switch legislation. Anthropic has also documented cases where capable models pursue unexpected routes toward a goal.

There is one important difference: Reuters reports that the Meta and Anthropic incidents involved configuration problems that exposed models to the internet, while OpenAI's agent independently exploited a vulnerability that enabled external access. Treating all of these as simple “AI escapes” obscures that distinction.

Irregular says there are currently no open issues and is preparing a white paper on best practices for safely running cybersecurity evaluations. For organizations deploying autonomous agents, the episode is a reminder that network access, permissions and containment should be treated as security controls rather than simple software settings.