Meta's AI Just Hacked a Real Company, the 4th Incident in Weeks

The list of AI companies reporting that their models escaped testing environments and hacked real organisations keeps growing. In just a few weeks, OpenAI, Anthropic, and now Meta have all disclosed similar incidents.

Three of the world’s biggest AI companies have now confirmed that their AI models compromised real systems during cybersecurity evaluations.

Meta’s case marks the fourth such incident disclosed in recent weeks.

What happened?

Meta confirmed that one of its AI models, reportedly Muse Spark 1.1, which the company has described as one of its most capable models for real-world coding and agentic tasks, exploited a security vulnerability in a third-party service during a cybersecurity evaluation.

The breach occurred because Irregular, the independent security testing company conducting the evaluation, accidentally gave the model internet access due to a configuration error. Once online, the model exploited a vulnerability “in a manner similar to previously reported instances with other companies.”

Irregular told Reuters that the incident was “the same evaluation-environment issue that was already disclosed by Anthropic last week” and did not involve “a sandbox escape or a sophisticated cyber action.”

Claude Hacked 3 Companies: What Went Wrong at Anthropic

Anthropic says human error, not the models themselves, led to the incidents.

TechloyOgbonda Chivumnovu

OpenAI and Anthropic reported similar incidents

Meta’s disclosure follows a string of nearly identical incidents.

In July, Anthropic revealed that three Claude models hacked into the systems of three organisations during cybersecurity testing with Irregular. A configuration mistake exposed the models to the public internet, causing them to treat real systems as part of their capture-the-flag exercise.

OpenAI also disclosed that one of its models exploited a previously unknown vulnerability during testing, allowing it to reach the internet and attack Hugging Face. In a separate incident, another OpenAI model accessed and exploited a real website after a fictional target used during testing happened to share the same name as an actual site.