Meta AI model breach puts cyber testing controls on trial

A Meta AI model reached the public internet during a cyber evaluation and exploited a flaw in an outside service, Meta said.

The company identified the system as Muse Spark 1.1, a recently released model that was being tested with cybersecurity vendor Irregular. Meta said the model should not have had internet access, but a setup error in the evaluation environment opened that path.

Muse Spark reached live systems

The incident puts Meta into a fast-growing safety problem for advanced AI agents: models that can find weaknesses in software and act on them during tests. The outside service was not named, and Meta has not said what systems were affected or whether data was accessed.

Meta spokesperson Andy Stone attributed the breach to the testing setup rather than a planned live exercise. “A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” Stone said in a statement.

Stone said the model then used a vulnerability in the third-party service, resembling incidents recently disclosed by other AI developers. Meta learned about the episode after Irregular alerted the company, and Meta said it is investigating before publishing a fuller account.

Irregular evaluations draw scrutiny

The same vendor has now been tied to similar recent breaches reported by OpenAI and Anthropic PBC. In the past two weeks, those companies said their models reached outside institutions during cyber capability tests that were expected to remain contained.

Anthropic said its Claude model had been told the environment was simulated and lacked internet access. The company later said a misunderstanding with its evaluation partner meant that condition did not hold, and the models breached three organizations during the tests.

OpenAI also said its models used a misconfigured test environment to connect to the internet and compromise the website of an unidentified institution. The overlap across Meta, OpenAI and Anthropic shifts the issue from a single-company lapse to a question about how frontier-model evaluations are built and supervised.

Irregular confirmed the Meta episode involved the same evaluation-environment issue previously disclosed by Anthropic. “This did not involve a sandbox escape or a sophisticated cyber action. There are no current open issues,” an Irregular spokesperson said, adding that the company is preparing a white paper on secure containment for cyber evaluations.

Containment becomes the product

Irregular is part of a younger group of companies selling security tests for frontier AI models as businesses and governments worry about AI-assisted hacking. The Tel Aviv-based company was founded in 2023 by Chief Executive Officer Dan Lahav and Chief Technology Officer Omer Nevo.

The firm, formerly known as Pattern Labs, runs simulations designed to measure how models could be misused in cyberattacks and how well they withstand hostile prompts or targeting. It has raised $80 million in a funding round led by Sequoia Capital and Redpoint Ventures, and has said it generates millions of dollars in annual revenue.

For Meta, the direct risk is reputational as much as technical. The company needs to show that Muse Spark 1.1 did not expose customer data, that the third-party service has been remediated, and that its testing controls can prevent repeat access to live systems.

The industry effect could be larger. If companies conclude that outside evaluations cannot be safely contained, buyers may demand custom security harnesses, stricter vendor audits and deployment models that keep sensitive workloads inside their own infrastructure.

Analyst Mandeep Singh said corporate technology buyers are already placing more weight on data-sovereignty, security and compliance risks when choosing AI providers. His view points to a commercial divide: cloud platforms with mature enterprise controls may gain an advantage over frontier-model developers that rely on newer testing chains.

Three paths for AI testing

If Meta’s review finds the incident was isolated and containment fixes are straightforward, the macro effect may be limited to tighter procurement checks rather than slower AI adoption. Meta would still need to publish a credible retrospective, while the AI security sector would likely turn the episode into a checklist for safer cyber evaluations.

If the review uncovers broader flaws across shared testing infrastructure, regulators and major enterprise buyers could press for tougher standards before models are approved for cyber-related work. Meta would face deeper questions about vendor oversight, and security startups would have to prove their test environments are safer than the risks they are hired to measure.

If more model breaches surface, the global AI market could move toward more restricted deployments, including private infrastructure and open-weight systems customized inside corporate networks. That would raise costs for buyers, pressure Meta to strengthen enterprise assurances, and push the wider sector toward containment as a core feature rather than an after-test safeguard.