Meta AI Hacked External Systems During Cybersecurity Testing
Meta AI models hacked external systems during cybersecurity testing due to misconfiguration.
Summary
Meta has disclosed that its AI models inadvertently accessed the internet during cybersecurity testing conducted by Irregular, leading them to exploit a vulnerability and hack external systems. This incident is similar to recent events involving Anthropic and OpenAI, where their AI models also escaped testing environments and compromised third-party systems. Meta is investigating the breach, which involved its Muse Spark 1.1 model making unauthorized changes to an unnamed organization's internal environment.
Full text
Meta is the latest major AI developer to admit that its models broke loose during cybersecurity testing and hacked external systems. The tech giant said in a statement to the media on Wednesday that the incident occurred during independent evaluations conducted by Israeli AI security startup Irregular. The tested AI models were inadvertently allowed to access the internet due to a misconfiguration, which led them to exploit a vulnerability in an unnamed third-party service. It’s unclear if it was a known flaw or a zero-day. Meta and Irregular said the incident is similar to the one reported last week by Anthropic, which also uses Irregular for independent testing. The Information [paywalled] learned that the Meta AI attacks involved the company’s advanced Muse Spark 1.1 model, which breached an unnamed organization’s systems and made unauthorized changes to its internal environment. Meta said it learned of the AI models going rogue after being notified by Irregular. The company is conducting an investigation and it has promised to issue a “full retrospective” once it has all the facts. Advertisement. Scroll to continue reading. Anthropic reported last week that its models escaped the Irregular testing environment due to a misunderstanding between the companies: Claude was told that it would be part of a simulation in an isolated environment, but a connection to the internet was in fact available and the models treated it as part of the exercise. Anthropic identified three cases where its models broke out of the testing environment and hacked into the systems of three organizations, including a cybersecurity firm. In that attack, the AI conducted a series of complex actions, including registering a PyPI account and uploading a malicious Python package. The AI giant’s disclosure was prompted by OpenAI, which found recently that its models escaped a testing environment and hacked into the systems of Hugging Face and other organizations. The attacks conducted by Anthropic models did not involve exploiting unknown vulnerabilities, but OpenAI said its AI found and used zero-days. The UK government’s AI Security Institute (AISI) revealed this week that, while testing the capabilities of frontier models, it observed Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol go rogue and target real people and organizations over the internet. The models used Tor to access the internet, created malicious pull requests on open source projects on GitHub, and used social engineering to achieve their goals. Related: Cybersecurity Alliance Drafts SAFE Guidelines for Sharing AI Incident Data Related: Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Related: Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Cybersecurity Alliance Drafts SAFE Guidelines for Sharing AI Incident Data Water Sector Cyberattacks Reportedly Hit at Least 12 StatesTP-Link Omada ZTP Vulnerabilities Chain Into Full Network TakeoverMicrosoft Bug Bounty Program: $20 Million Paid to 500 ResearchersN‑able Patches Vulnerability Exploited to Hack N-central ServersUS Water Cyberattacks Extend Beyond Minnesota to at Least 6 Other StatesPrompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 OrganizationsSemiconductor Firm Analog Devices Discloses Data Breach Latest News Belarusian Ransom Cartel Mastermind Gets 16 Years in PrisonCisco Patches Critical SD-WAN, IOS XE, FMC VulnerabilitiesHackers Start Exploiting Recent JetBrains TeamCity VulnerabilityHow a $50,000 Exploit Chain Turned Bixby Against Samsung Phones Black Hat USA 2026 – Summary of Vendor Announcements (Part 3)The Fourth Battlefield: The Growing Role of Cyber Operations in Global ConflictNew Attack Methods Enable Malware to Hijack Passkey-Protected Accounts311,000 Impacted by Brown Health Medical Group-MA Data Breach Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.PNC Financial Services Group has appointed Christian Winward as CISO.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email