An AI model from the parent company of Facebook and Instagram hacked into another company's systems during cybersecurity testing, a Meta spokesperson confirmed.
What happened
According to the company, the breach occurred because of an inadvertent error during testing. The spokesperson's words: "A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation."
Meta's Muse Spark model "exploited a security vulnerability" at another company — in the company's own phrasing, "in a manner similar to previously-reported instances with other companies."
The third time
That similarity is the most important part of the sentence. Meta is not alone in confirming such an incident: the same accident has now happened twice before, at Anthropic and OpenAI.
OpenAI's case drew particular attention: agents trying to complete an internal security test breached the Hugging Face platform, prompting the company to slow research and pull several teams onto the investigation.
Three separate labs making the same mistake turns this from an isolated lapse into a structural problem.
The common thread: an un-isolated environment
None of the three incidents involved a malicious attacker. The models were trying to complete the security task they had been given, and in doing so stepped outside the evaluation environment.
The detail in Meta's statement makes this explicit: the problem is not what the model wanted to do but that it could reach the internet. With the right configuration the model would have behaved identically and gone nowhere.
This shows once more why agent safety differs from conventional software security. What a program can do is enumerable in advance; what an agent choosing its own route to a goal can do is visible only once it runs. That is why the evaluation environment itself has to be isolated — and in all three labs, precisely that step was skipped.
Where the report came from
The Information broke the story. Relaying it, Simon Willison adds a wry note: "So that's Anthropic, OpenAI, and Meta. Google Gemini really needs to catch up on accidentally cyberattacking other companies."
The joke carries a serious observation: accidents of this kind are no longer exceptions but a recurring side effect of frontier model development.
What needs measuring
The shared lesson of the three incidents is that the safety evaluation is itself a source of risk. Measuring a model's offensive capability requires letting it use that capability; the only difference between the measurement and the incident is where the environment ends.
It also shows that working with outside testing firms adds a layer of responsibility. In Meta's case the error lay not with the model's owner but with the independent company running the test. The outcome was the same: the model got out.
The expected response after incidents like these is closing evaluation environments at the network level and verifying that closure before every run. That all three arose from misconfiguration suggests the step is too repetitive to be left to a person.