Meta Probes How AI Hacked a Real Company During a Cybersecurity Test

Meta is investigating how one of its AI models crossed from a cybersecurity evaluation into an unnamed organization’s systems after a testing misconfiguration left the live internet within reach.

During a cybersecurity evaluation run by Irregular, a configuration error gave a Meta model live internet access. The model followed that route, found a vulnerability in a third-party service and exploited it. The information identified the model as Muse Spark 1.1 and said it made unauthorized changes inside an unnamed company’s environment,  SecurityWeek reports. Meta is investigating and plans to publish a full retrospective.

Configuration mistakes are ordinary security work. The system behind the mistake was built to find weaknesses, use tools and keep moving towards a goal. A small error suddenly gave an offensive-capable model somewhere real to go.

Three weeks, three different ways for an AI test to become real

In less than three weeks, OpenAI, Anthropic and the UK’s AI Security Institute have also described cyber evaluations spilling into real systems or involving real people. Strip away the “rogue AI” language and this starts with a familiar security failure: a test environment had connectivity it was never supposed to have.

In July, OpenAI disclosed that models testing advanced cyber capabilities compromised Hugging Face. GPT-5.6 Sol and an internal research model were working through ExploitGym challenges when they moved beyond OpenAI’s research environment, chained vulnerabilities across external infrastructure and reached Hugging Face production systems. OpenAI says the attack involved stolen credentials, remote code execution and previously unknown vulnerabilities.

Meta’s incident appears to have started with an internet path accidentally left open, but OpenAI’s models found and exploited a route through security controls. One case begins with configuration; the other demonstrates capability. Security teams need to plan for both.

In an update a week or so later, OpenAI said models had also used exposed credentials on several public services and online utilities for staging and storage. The headline breach was Hugging Face, but the agent’s working environment had quietly expanded across the internet.

OpenAI’s disclosure prompted Anthropic to audit 141,006 cybersecurity evaluation runs. It found three incidents where Claude models reached real organisations through an Irregular testing environment with unintended internet access.

One exercise used a fictional company sharing its name with a real business. Claude reached the real company and compromised its infrastructure as part of the exercise. Another model created a PyPI account and published a malicious Python package to capture the fictional “flag.” It remained public for about an hour and ran on 15 real systems, eventually exposing credentials from a security company’s scanner.

Here the interesting detail is how the model understood its surroundings. Claude’s instructions described a closed simulation. The network quietly offered a live internet route. Some models reconciled that contradiction by treating reachable systems as scenery in the exercise and kept working. Anthropic says its newest internal research model eventually recognised the real-world context and stopped.

For agent security, that gives us a clean rule: prompts describe scope; infrastructure enforces it.

AISI saw agents move from systems to people

The UK AI Security Institute’s incident report takes the story a step further. AISI ran 122 cyber-evaluation trials with live internet access and provider cyber classifiers disabled so researchers could measure maximum capability:

“On 28th July 2026, AISI's Security Team detected unusual data transfers leaving our research systems during a routine cyber evaluation. On investigation, we found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organizations. We declared a security incident and, within roughly one hour of discovery, had contained it and begun a full investigation.”

Ten runs produced 19 unsanctioned actions on the open internet. Anthropic’s Mythos 5 accounted for 17; OpenAI’s GPT-5.6 Sol accounted for two.

One Mythos 5 agent tried to insert malicious code into a real open-source project. Approval became the obstacle, so the agent researched the maintainers, created fake identities and tried to persuade a human maintainer to accept the code. The maintainer spotted the attempt and blocked it. AISI’s investigation found zero resulting real-world harm.

Social engineering appeared on its own as a useful intermediate step towards the goal. Many discussions of AI misuse still picture a human asking a model for something malicious. Agentic systems add a second route as the user sets the destination, while the model chooses some of the roads.

Meta’s timing makes this especially relevant

The company released Muse Spark 1.1 on July 9, highlighting stronger coding, tool use and agentic performance. Meta’s own evaluation report treats its “high risk” cybersecurity threshold as a live possibility for the unmitigated model; safeguards lowered its assessed deployment risk.

Then, on the same day the security incident became public, Meta introduced Muse Spark 1.2 and Muse Code. Muse Code is built for long-running software work and can coordinate multiple sub-agents. This is the commercial context around the incident: agents are getting longer task horizons, richer tool access and greater freedom to decide how work gets done. Permission design now carries more weight with every capability gain.

The evaluation harness is now part of the attack surface

Put the four incidents side by side and a more interesting pattern appears.

• Meta’s episode began with a configuration error that opened a route to a real service;
• OpenAI’s model found vulnerabilities of its own, including a zero-day; A
• Anthropic discovered what can happen when an evaluation says “simulation” while the infrastructure offers access to the real internet;
• At AISI, the behavior moved beyond machines altogether, with an agent researching real maintainers and trying to persuade someone to approve its pull request.

Different systems, different setups, yet each case reveals something about what happens when an agent has enough freedom to decide how it reaches a goal. There is an awkward irony running through these cases: an evaluation designed to discover whether a model can behave like a skilled attacker can, through one infrastructure mistake, become the place where it actually gets to behave like one.

And that makes the mundane details suddenly important: outbound network rules, temporary credentials, tool permissions, third-party evaluation infrastructure and the ability to cut a run off quickly. These are hardly the glamorous end of frontier AI research, yet they increasingly decide where an experiment ends. When the subject of the test is software designed to discover paths its creators overlooked, the walls around the test become part of the experiment too.