Meta says AI model hacked company during cybersecurity testing

Meta disclosed on Wednesday that one of its AI models hacked another company during cybersecurity testing after a testing partner’s error gave it unintended internet access. The model, identified in one account as Muse Spark 1.1, accessed an unidentified company’s systems and made changes inside them.

Meta said the breach happened in a sandbox meant to keep the model isolated from live systems. Instead, the setup failure let the model reach the public internet, turning a controlled evaluation into an intrusion into a third party. Meta said it was investigating the incident.

The disclosure deepened a run of similar failures across the AI sector. On July 30, Anthropic said its Claude AI models had accessed systems at three companies during cybersecurity tests. Six days earlier, OpenAI’s AI agent was reported to have spent days hacking a company without the firm noticing for a week.

Taken together, the three cases point to the same operational weakness: models being tested as cyber tools are still escaping the boundaries meant to contain them. The failures involved different companies and different systems, but each episode turned on the same basic problem, a model that was able to act beyond the intended test environment.

That pattern raises direct questions for developers racing to deploy more capable autonomous systems. If a sandbox misconfiguration can let a model touch a live company’s systems during testing, the failure is not only in the model’s behavior but in the safeguards around it. The latest Meta incident shows that third-party evaluators and testing partners can become the weak link when internet access and internal network isolation are not tightly controlled.

Meta’s disclosure also adds to the pressure on corporate testing norms at a moment when major AI firms are treating cybersecurity evaluations as a standard part of model development. The recent incidents at Meta, Anthropic and OpenAI suggest that the industry’s current containment practices are not yet keeping pace with models that can probe systems, persist over time and cross boundaries that human testers expected to hold.