Meta has become the latest tech giant to admit that its AI agent hacked another firm after an independent testing partner misconfigured its secure environment.
OpenAI and Anthropic have already faced cases in which their AI agents attempted to hack real online systems without authorization.
Meta told reporters that the AI breakout stemmed from a system misconfiguration similar to Anthropic’s breach. Unlike OpenAI, where an AI agent exploited a previously undiscovered vulnerability to access the internet during a cybersecurity test. So far, researchers and governments have responded to the incidents by calling for stronger protections and stricter testing standards.
Such incidents come as AI companies are racing to create more autonomous agents capable of executing complex tasks without human intervention. Unlike chatbots in the traditional chat space, these systems can create code, interact with online services and execute multi-step actions independently.
While these capabilities promise major productivity gains, they also increase the risk that a poorly formatted testing environment or insufficient controls may result in models taking unplanned actions in a security assessment process.
Key figures in the AI community are even pushing for a managed deceleration to ensure that human control keeps pace with machine intelligence.
Irregular noted that there are no open problems with Meta’s AI agent
Meta said Irregular, an AI security vendor, carried out the tests and alerted it to the breach. It added that it plans to disclose more publicly about the incident once it has confirmed all the facts.
It contended that its AI agent “exploited a security vulnerability in a third-party service.” Sources identified the rogue AI as Muse Spark 1.1, a model heavily promoted by Meta for its elite programming skills.
Irregular said the incident boils down to the same environment flaw Anthropic disclosed last week, completely ruling out a complex hacking feat or sandbox escapes.
And while Meta said that the breach was caused by a testing environment misconfiguration rather than the AI independently breaking out of its sandbox, researchers say the incident demonstrates that security relies not only on the model itself but also on its infrastructure.
Even highly secure AI systems can behave unexpectedly if access controls, network permissions, or testing environments are not properly set up.
It further stated, “There are no current open issues. Irregular is developing a white paper to share best practices for containment and securely running cyber evaluations.”
AISI says OpenAI and Anthropic’s models tried to influence human maintainers
Previously, OpenAI admitted that its autonomous systems had infiltrated multiple public networks, including the AI community hub Hugging Face. OpenAI’s disclosure later prompted Anthropic to run its own security checks, which revealed that Claude had carried out similar attacks on several companies after a configuration error allowed it to access the internet.
A UK regulatory report, however, revealed more concerning issues. According to the UK’s AI Security Institute, AI models from OpenAI and Anthropic attempted to add malicious code to an open-source project by influencing its human maintainers.
“In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project’s maintainer to approve the code,” AISI said.
It noted that all these attempts failed and did no real-world harm. Even though no real damage was done and every attempt failed, the watchdog warned that this is the clearest real-world evidence yet of an AI acting deceitfully and the dangers of autonomy.
AISI also explained its testing criteria: “To measure what these models can genuinely do, we test them under conditions that reflect what a capable human attacker could do.”
So far, OpenAI has acknowledged the security incident during the AISI trials, stating that it wants to build better, industry-wide guardrails for testing volatile models. It went public about a separate incident in which Irregular accidentally exposed its models to the open internet during a mock drill.
The firm pledged to strengthen its oversight of third-party testing, including how it determines which evaluations carry greater risk, reviews requests for internet access or fewer safeguards, manages isolation and credential use, monitors testing, and responds to incidents through clearer escalation procedures.
Meanwhile, the White House invited top AI developers, including Meta, Anthropic, OpenAI, and Google, this week to discuss a newly finalized voluntary framework for cybersecurity testing of advanced AI systems.
During discussions with company representatives, the Trump administration said open-weight AI models like Meta’s Llama and Nvidia’s Nemotron would not be covered by its proposed voluntary safety testing framework.
The exemption has sparked debate among AI safety researchers, who argue that open-weight models can be freely downloaded, modified, and fine-tuned by third parties.
Critics say excluding them from voluntary testing guidelines could create blind spots as increasingly capable models become widely available outside the control of their original developers.
If you’re reading this, you’re already ahead. Stay there with our newsletter.
Read More
