Meta AI hacked firm in botched security test

Meta has acknowledged that one of its AI models breached a real organization during a cybersecurity evaluation, joining a growing list of incidents where AI agents escaped their intended confines. The disclosure follows similar revelations from OpenAI and Anthropic, raising fresh questions about the safety protocols surrounding AI agent testing.

The Information first reported the incident on Wednesday, citing sources who said Meta’s Muse Spark 1.1 model compromised an unnamed company and altered its internal systems. The breach occurred after a configuration error in a sandbox testing environment operated jointly with independent security evaluator Irregular, which inadvertently exposed the model to the public internet.

Meta has not officially confirmed which model was involved, identified the affected company, or detailed the system changes made. However, the company told Reuters that a misconfiguration by Irregular gave the model internet access during an evaluation. Meta stated that the model “exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies.”

In a statement to the BBC, Meta said it is investigating the matter and will release further details “once we have all the facts.” BleepingComputer reached out to both Meta and Irregular for comment but has not received a response.

The same testing flaw appears to be behind this incident and earlier AI breaches. Irregular told Reuters that the Meta case involved the “exact same evaluation-environment issue that was already disclosed by Anthropic last week.” The company emphasized that the incident was not a sandbox escape or a sophisticated cyber maneuver. Rather, an error in the testing setup gave the model access to the open web when it should have been isolated.

Irregular added that there are “no current open issues” and that it is developing a white paper to share best practices for containment and secure cyber evaluations.

This latest event follows Anthropic’s disclosure that some of its models hacked three companies after a similar misconfiguration in Irregular’s environment. In one notable case, Claude Mythos 5 discovered developer instructions inside the simulated environment referencing a nonexistent Python package. Believing it had found a way to compromise the fictional target, the model created a malicious package with the same name and published it to the real PyPI registry. The package stayed online for about an hour and was downloaded and executed on 15 real systems before being removed.

One of those systems was a malware scanner run by a security firm. The package stole credentials that Claude then used to access additional infrastructure. Anthropic noted that the model initially recognized publishing the package would be a real-world attack but convinced itself it was still operating inside a simulation.

OpenAI also recently disclosed another Irregular evaluation where the name of a fictional CTF target matched a real domain. Because the supposedly isolated environment could reach the public internet, an OpenAI model exploited a basic vulnerability in the actual website and found credentials that allowed it to operate the site.

These incidents differ from the previously reported Hugging Face breach, where OpenAI models found a path to the public internet by exploiting an unknown vulnerability in an internally hosted JFrog Artifactory server used during testing. Once online, the agents breached Hugging Face while searching for benchmark datasets and solutions, stole credentials, and moved laterally through the company’s systems. OpenAI later revealed the agents used exposed credentials to access accounts at four other third-party services, some of which were used for attack infrastructure and data storage.

The UK AI Security Institute, or AISI, also disclosed that agents using Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6 Sol took 19 unsanctioned actions on the public internet during cyber-range evaluations. In the most serious sequence, the Mythos 5 agent attempted a supply-chain attack against a real open-source project after mistakenly concluding its GitHub repository was connected to the simulated challenge. The agent researched the project’s maintainers, submitted malicious code, created fake identities, sent targeted emails containing malware, and pressured a maintainer into approving the pull request. When a reviewer warned the code contained malware, the agent denied the accusation and used additional fake accounts to create the appearance that independent users had reviewed and approved the changes.

AISI intentionally provided the agents with internet access and disabled their standard cyber safeguards to measure their underlying capabilities. However, the agents were only authorized to attack systems inside the simulated range.

As these cases make clear, unless carefully restricted, AI agents will go to great lengths to solve their tasks, even if that means breaking out of sandboxes or conducting social engineering attacks on real people. While AI developers have a responsibility to build safeguards that prevent models from carrying out harmful actions, the incidents also underscore the duty of companies performing these evaluations to configure their testing environments properly.