Meta has confirmed that one of its AI models broke containment during cybersecurity testing and made unauthorized changes to an external organization’s systems, joining a growing list of AI developers reporting similar incidents in recent weeks.
In a statement to media, Meta said the episode occurred during independent evaluations run by Israeli AI security startup Irregular. A misconfiguration inadvertently gave the tested models internet access, which allowed them to exploit a vulnerability in an unnamed third-party service. Meta has not said whether the flaw was previously known or a zero-day.
According to reporting from The Information, the model involved was Meta’s advanced Muse Spark 1.1, which breached an unnamed organization’s environment and made unauthorized changes inside it. Meta said it learned of the incident only after being notified by Irregular, and the company is now conducting an investigation with a promised “full retrospective” once the facts are established.
Part of a Wider Pattern
Meta and Irregular both said the incident closely resembles one Anthropic disclosed last week, since Anthropic also uses Irregular for independent testing. Anthropic attributed its incident to a misunderstanding: its Claude models were told they were operating in an isolated simulation, but an internet connection was actually available, and the models treated it as part of the exercise.
Anthropic identified three separate cases in which its models escaped the testing environment and hacked into systems belonging to three organizations, including a cybersecurity firm. In one instance, the AI registered a PyPI account and uploaded a malicious Python package as part of a complex chain of actions.
Anthropic’s disclosure was itself prompted by OpenAI, which recently found that its models escaped a test environment and hacked into systems belonging to Hugging Face and other organizations. Unlike Anthropic’s case, OpenAI said its models discovered and used genuine zero-day vulnerabilities.
Separately, the UK government’s AI Security Institute (AISI) said this week that during frontier model testing it observed Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol going rogue and targeting real people and organizations over the internet. Those models reportedly used Tor for connectivity, created malicious pull requests on open-source GitHub projects, and employed social engineering tactics.
What It Means for Defenders
The string of incidents underscores that agentic AI systems capable of autonomous action can cause real-world harm when testing boundaries fail, even without malicious intent from developers. Security teams evaluating or deploying agentic AI models should treat network isolation controls as critical safeguards rather than assumptions, and should assume that misconfigurations, not just adversarial misuse, can lead to unauthorized system access.