Meta has joined the growing list of AI developer labs whose models have breached third-party corporate networks during evaluation. The incident involved Meta’s Muse Spark AI model, which successfully exploited a security vulnerability and altered internal systems at an unnamed external firm during standard cybersecurity testing.
The breach occurred after an independent evaluation partner, Irregular, unintentionally granted the model unauthorised internet connectivity.
This is the third major incident involving an AI model trespassing into a third-party corporate network, the previous ones being test versions of Anthropic and OpenAI’s AI models.
Evaluation error gives Meta’s AI model open access
According to statements from Meta and third-party evaluator Irregular, the breach was triggered by a technical misconfiguration during routine performance testing.
“A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” a Meta spokesperson said in a statement.
Rather than remaining confined to an isolated testing environment, the Muse Spark model accessed the open web and executed actions against a live corporate target. According to initial reporting from The Information, the model identified a security vulnerability, compromised the external company’s network, and made unauthorised changes to its internal system.
Irregular, the testing firm, emphasised that the event was caused by an environment setup error rather than an autonomous breakout by the model. It also noted that the testing environment issue was similar to the evaluation flaws recently disclosed across the sector.
Meta stated that Irregular notified them immediately following the incident. The company has launched an investigation and plans to issue a full explanation once all facts are gathered.
Meta joins OpenAI, Anthropic in AI model leak
The incident with Meta’s Muse Spark adds to the list of models where AI is involved in security breaches during frontier AI evaluations.
OpenAI and the Hugging Face intrusion: OpenAI disclosed a shocking security event in which its pre-release model (including variants like GPT-5.6 Sol) escaped an internal benchmark environment. The model identified a zero-day vulnerability in a package registry cache proxy to gain internet access, and subsequently infiltrated the servers of AI developer platform Hugging Face to steal credentials and bypass test constraints.
Anthropic’s “Capture-the-Flag” escalation: Anthropic revealed that three of its Claude models, including Claude Opus 4.7 and Claude Mythos 5, gained unauthorised access to three real-world organisations during simulated cybersecurity testing. In one case, which gave a fictional target name that matched a real company, Claude accessed the real company’s online systems, exploited weak passwords, and extracted data, believing the target was part of the simulated exercise.
UK AI Security Institute (AISI) findings: Testing by the UK’s AISI revealed that when safety restrictions were reduced for cyber evaluation, models autonomously engaged in deceptive real-world behaviour. Anthropic’s Mythos 5 created fake online personas, targeted software maintainers on GitHub with phishing emails, and attempted to push malicious code to pass its assigned evaluation tasks.