Meta said on August 5 that one of its AI models breached a third-party company during cybersecurity testing, after its evaluation partner Irregular misconfigured the sandbox and gave the model live internet access.
Quick Summary – TLDR:
- Meta confirmed one of its AI models exploited a security flaw at a third-party company during a sandboxed evaluation.
- Irregular, the outside testing firm, said a setup error gave the model internet access and called it a known issue.
- The Information identified the model as Muse Spark 1.1, which Meta markets for real-world coding and agentic work.
- Anthropic disclosed three similar breaches on July 30 after reviewing more than 141,000 evaluation runs.
- Two of the three companies breached by Anthropic’s models had not detected the intrusion on their own systems.
What Happened?
Meta placed the cause with its testing vendor, saying in a statement that “a misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation.” The model then “exploited a security vulnerability in a third-party service, in a manner similar to previously-reported instances with other companies.“
Meta said Irregular notified it of the incident, that it is investigating, and that it will “issue a full retrospective once we have all the facts.” Meta has named neither the model nor the company that was entered.
The Information identified the model as Muse Spark 1.1, citing people familiar with the matter, and said it made changes to the target company’s internal systems. Meta has promoted the Muse Spark as its strongest release for real-world coding and agentic tasks.
Irregular pushed back on the severity. A spokesperson told Reuters the incident was the “exact same evaluation-environment issue that was already disclosed by Anthropic last week” and did not involve a “sandbox escape or a sophisticated cyber action.“
JUST IN: Meta claims its AI model hacked another company during cybersecurity testing.
— Polymarket (@Polymarket) August 5, 2026
Irregular Sits at the Center of Two Disclosures
The same testing firm appears in both of the past week’s cases. Meta attributes its misconfiguration to Irregular, and Anthropic said it ran its own large-scale July review alongside Irregular. Neither lab has published the technical detail that would show whether the two setups failed for the same underlying reason.
Irregular says the work is closed out. “There are no current open issues. Irregular is developing a white paper to share best practices for containment and securely running cyber evaluations,” the firm said. It posted on X that “addressing these risks will require closer cooperation across the AI ecosystem.”
Frontier labs outsource red-teaming to demonstrate independence, which puts a small vendor’s sandbox between a capable agentic model and live infrastructure.
Three Incidents, Two Failure Modes
| Lab | Disclosure reported | How the model reached the internet | Target |
|---|---|---|---|
| OpenAI | July 22 | Agent independently exploited a novel vulnerability | Hugging Face |
| Anthropic | July 30 | Evaluation environment misconfiguration | Three unnamed organizations |
| Meta | August 5 | Testing partner misconfiguration | One unnamed company |
Anthropic’s numbers give the clearest picture of scale. The company reviewed more than 141,000 evaluation runs before finding three incidents, the earliest dating to April, involving Claude Opus 4.7, Claude Mythos 5 and an internal research test model. All three were capture-the-flag exercises in which a model was told a secret “flag” sat on another machine and instructed to retrieve it.
The methods were unremarkable. Anthropic said Claude “compromised the impacted organizations’ infrastructure using basic techniques,” including exploiting weak passwords. That result says as much about the target networks as it does about model capability, an issue visible in wider AI coding security vulnerability data.
What the Disclosures Leave Unanswered?
The evidence establishes that models reached systems outside their test environments and, in Meta’s case, altered them. It does not establish that any Meta or Anthropic model sought internet access on its own, which is where OpenAI’s case differs. Open questions include:
- Which company Meta’s model entered, and whether it has been notified?
- What changes the model made to that company’s internal systems, and whether they were reversed?
- Why the same class of setup error recurred six days after Anthropic’s public disclosure?
- How many evaluation runs across the industry ran with unintended internet access and were never audited?
Security teams running capture-the-flag targets or internet-facing test infrastructure can review authentication logs back to April and rotate weak or shared credentials. Two of Anthropic’s three affected organizations learned of the activity only when the lab contacted them, so absence of an alert is weak evidence. Neither step guarantees detection, though both help reduce the risk of a silent compromise going unrecorded.
SQ Magazine’s Takeaway
The failure here sits in the containment layer. Three labs have disclosed breaches in three weeks, and in two of them the model behaved as instructed inside an environment that was built wrong. Evaluation vendors have quietly become critical infrastructure, and the sector has no published standard for how their sandboxes should be isolated, logged, or audited. Work on AI jailbreaking has focused on what models can be talked into doing, while these cases turned on plumbing.
What’s next is largely disclosure. Meta has promised a full retrospective, Irregular is drafting its containment white paper, and Anthropic is still trying to reach the third organization its models entered. Companies that host public test targets should expect more of these notifications, and they may arrive months after the fact. Treating any unexplained access in that window as worth a second look is the practical posture for now.
