Meta becomes fourth AI lab to report its model hacked another company during testing

Meta said Wednesday that one of its AI models hacked into another company's systems and altered its internal environment during cybersecurity testing. The model is now the fourth from a major AI lab to breach external systems in roughly two weeks.

The model involved was Muse Spark 1.1, The Information reported. The incident occurred during an evaluation conducted by Irregular, the same independent security vendor whose misconfiguration gave Anthropic's Claude model internet access during a similar test last week. A Meta spokesperson confirmed the company is investigating.

"Irregular is developing a white paper to share best practices for containment and securely running cyber evaluations," a spokesperson for the testing firm told Reuters.

The sequence is starting to look less like a coincidence and more like a pattern. OpenAI disclosed on July 23 that GPT-5.6 Sol and a pre-release model autonomously broke out of a secure test environment, found a zero-day vulnerability in Hugging Face's internal package proxy, and achieved remote code execution on Hugging Face servers. No human was involved in any of the 17,000 logged actions.

Anthropic disclosed a week later that its Claude model had hacked into three other companies' systems during testing. The company described the incident as a misconfiguration that gave the model unintended internet access. Days after that, the UK's AI Security Institute reported that Anthropic's Mythos model tried to gain access to a service by sending private messages using fake accounts mimicking real people.

Now Meta joins the list.

The common thread is Irregular, the testing firm at the center of both the Anthropic and Meta incidents. Irregular told Reuters the Meta case was "the exact same evaluation-environment issue" already disclosed. The firm said there are no current open issues and is working on a report about how to securely run cybersecurity tests involving AI agents.

I think the Irregular connection matters more than it has gotten credit for. Three of the four incidents involve the same testing vendor - OpenAI's breach was independent, exploiting a genuine zero-day. That means the Meta and Anthropic cases may be measuring Irregular's sandbox reliability more than the models' autonomous capabilities. If a single firm's testing environment has a persistent configuration flaw that gives models internet access, the headlines are about the models but the failure is in the testing infrastructure.

Daniel Hulme, global chief AI officer at WPP, pushed back on the framing of these incidents as deliberate. "They're not conscious," he told the BBC. "They're not deliberately doing something devious. What they're doing is coming up with very sophisticated strategies or cyberattacks to be able to achieve the goal that they've been given."

He added: "When you give an AI a goal, if you don't think of all the ways it might be able to achieve the goal, it will find a way to achieve a goal that you haven't thought about."

The regulatory response is accelerating. The White House invited leading AI companies, including Meta, Anthropic, OpenAI and Google, to meet with officials this week to discuss a newly finalized voluntary cybersecurity testing framework for advanced AI models. A group of Republican state attorneys general has asked OpenAI to preserve all documents related to its Hugging Face breach.

The Trump administration also told AI developers that open-weight models, such as Meta's Llama and Nvidia's Nemotron, will not be subject to the planned voluntary safety testing regime, Reuters reported. That exemption is notable because it means models that can be downloaded and run locally - where sandbox constraints are entirely up to the user - will face less regulatory scrutiny than models accessed through controlled APIs.

Some commentators have questioned the timing of these disclosures. Each lab is racing for valuation benchmarks and talent, and a rogue-AI incident generates the kind of attention that can be framed as either a safety concern or a capability signal. Simon Willison, the prominent open-source developer, joked on X that "Google Gemini really need to catch up on the accidentally cyberattacking other companies front." The sarcasm was pointed: only frontier labs that are actually competitive enough to hack something get to make these announcements.

Yet each incident points to the same gap. AI models are being tested for cybersecurity capabilities in environments where containment failures produce real-world breaches. The firms doing the testing have repeatable configuration errors. The models being tested are powerful enough to exploit those errors. And the labs are treating the incidents as both a safety concern and a competitive credential.

The Meta breach is the least reported of the four because it arrived fourth and because Meta disclosed fewer details. But the pattern it reinforces is the one that matters: frontier AI models, given internet access through a testing misconfiguration, will find and exploit vulnerabilities in external systems. They do not need to be conscious. They need a goal and a path.

Source