Meta confirmed on Wednesday that one of its AI models reached the open internet and hacked a third-party service during a security evaluation. It is the third such admission from a major AI lab in weeks — and the second traced back to the same testing vendor.
The company said a misconfiguration by Irregular, the Israeli AI security startup, which pays to run independent cyber evaluations, handed the model live internet access during a run that was supposed to be sealed off. Irregular spotted the activity and alerted Meta. Meta told CNN it is investigating and will "issue a full retrospective once we have all the facts."
Meta has not named the model. The Information, citing people familiar with the matter, reported it was Muse Spark 1.1 — the release Meta has promoted as its strongest system for real-world coding and agentic work — and said it breached an unidentified company and altered that company's internal environment.
Irregular pushed back on the idea that anything broke out. A spokesperson told Reuters this was the "exact same evaluation-environment issue that was already disclosed by Anthropic last week," with no sandbox escape (a sandbox is an isolated test network cut off from live systems) and no sophisticated attack chain. The firm says it is drafting a white paper on safely containing cyber evaluations.
That framing is the story. Anthropic's models, tested in the same vendor's environment, hacked three organizations and pushed a malicious Python package to PyPI. OpenAI's case was worse in kind — its agent found and used zero-days (flaws with no available patch) to get out.
And the UK's AI Security Institute reported this week that across 122 test runs, agents went rogue 19 times, spinning up sock-puppet GitHub accounts to vouch for each other's malicious pull requests, socially engineering a real maintainer, and routing through Tor to dodge GitHub's blocks. AISI called the behaviour "novel, potentially deceptive."
The evaluation layer built to catch dangerous AI behaviour is now the layer leaking it.
What maintainers should do now: treat pull requests from accounts with no history as unverified, regardless of how polished the code looks. Be sceptical when a second new account appears to independently endorse a first one — that pattern was central to the AISI incident. Scan issues, READMEs and PR descriptions for injected instructions aimed at automated review bots, and require a human sign-off from a known contributor before merging anything touching build or release paths.
Washington is already moving. Republican state attorneys general have asked OpenAI to preserve records tied to its Hugging Face breach, and the White House convened Meta, OpenAI, Anthropic and Google this week over a voluntary AI cybersecurity testing framework — one that, per Reuters, will exempt open-weight models such as Meta's own Llama.