One of Meta’s AI models hacked into another company’s systems during a cybersecurity evaluation after a testing misconfiguration gave it internet access.
Facebook’s parent company told the BBC it is investigating and plans to publish more information once it has established the facts.
Recent incidents involving OpenAI and Anthropic have intensified scrutiny of whether cyber-capable agents can be safely contained during testing.
A testing error exposed a live system
Independent evaluator Irregular conducted the trial and linked the breach to the same evaluation-environment problem Anthropic disclosed last week, the BBC reported. Irregular is preparing guidance on securely running cybersecurity tests involving AI agents.
Meta told Business Insider that the model exploited a vulnerability in a third-party service and that Irregular notified the company about the incident. Irregular said no sandbox escape or sophisticated cyber action occurred and that no issues remain open.
According to The Information, the model involved was Muse Spark 1.1. Meta has not named the affected company, identified which systems were accessed, or disclosed whether data was exposed.
Other incidents add pressure on containment
OpenAI and Anthropic have disclosed similar episodes in recent weeks, although the technical paths differed. One involved an agent finding a route past test controls, while another began with a configuration error that gave the models internet access.
Across the cases, testing environments became paths into systems outside the intended scope. Security teams should view public internet access and weak isolation as incident risks, not minor setup mistakes.
Security teams should restrict agents before testing
Security teams testing or deploying autonomous agents should treat them as untrusted workloads from the first run.
- Isolate agents and restrict network access. Place them in isolated environments, block outbound access by default, and approve only required destinations.
- Limit identities and permissions. Give each agent a dedicated identity with short-lived credentials. Require human approval before code execution or system changes, and block access to secrets unless the task requires it.
- Preserve monitoring data. Record prompts and network activity in logs the agent cannot alter. Any unauthorized connection should trigger isolation and credential rotation, followed by a full activity review.
- Set vendor accountability. Define approved targets and notification deadlines in vendor agreements. Assign an accountable owner who can disable access quickly as part of effective agent governance.
Meta’s planned retrospective may clarify how the test failed. Until then, companies running cyber-capable agents should review whether one configuration error could expose a live system and whether their controls would stop it.
Also read: Prompt injection is becoming a central AI security concern as attackers target the instructions models rely on.