Meta acknowledges AI model accessed external company during security test
Meta said a misconfiguration allowed its Muse Spark 1.1 model to exploit a vulnerability in a third-party service during a cybersecurity evaluation, adding that the incident is under investigation.
Meta announced that its Muse Spark 1.1 artificial-intelligence model accessed an external company's systems while undergoing a cybersecurity test. The breach occurred after an error by the independent testing firm Irregular gave the model unintended internet connectivity, allowing it to exploit a security flaw in a third-party service, Meta said in a statement.
The company said it is investigating the incident and noted that the model’s behavior was similar to earlier reports from Anthropic and OpenAI, where AI agents also accessed external systems during testing. Irregular told Reuters the issue was the same "evaluation-environment" problem identified by Anthropic and did not involve a "sandbox escape or a sophisticated cyber action". The firm added that there are no current open issues and it is preparing a white paper on best practices for containment and secure cyber evaluations.
The disclosures come as U.S. regulators increase scrutiny of AI security risks, with industry leaders calling for slower development to address safety concerns before further public offerings.