- Meta said its Muse Spark 1.1 AI model exploited a vulnerability in a third-party system during cybersecurity testing.
- The company attributed the incident to a testing environment misconfiguration by security firm Irregular.
- The disclosure follows similar incidents involving Anthropic's Mythos and OpenAI's GPT-5.6 Sol.
Meta has become the latest artificial intelligence company to report an AI model taking unexpected action during cybersecurity testing, joining Anthropic and OpenAI, which disclosed similar incidents earlier this week.
The company said its Muse Spark 1.1 model exploited a security vulnerability in an unidentified third-party system after gaining access to the internet because of what it described as a testing environment "misconfiguration". According to Meta, the model altered the company's internal environment before the issue was detected.
The disclosure adds to a growing list of incidents involving advanced AI models behaving in ways researchers did not anticipate during controlled cybersecurity evaluations.
A testing error, not a real-world breach
According to a statement quoted by Reuters, Meta said Muse Spark exploited a vulnerability in a third-party service in a manner similar to previously reported incidents involving other AI companies.
The company said the model gained internet access because of a configuration error made by cybersecurity testing firm Irregular, which was running the evaluation.
An Irregular spokesperson reportedly said the incident involved the same evaluation environment issue disclosed by Anthropic and did not represent a sandbox escape or a sophisticated cyberattack. The company added that there are no outstanding security issues and said it is preparing a white paper outlining best practices for safely conducting AI cyber evaluations.
Meta stressed that the incident occurred during a controlled test rather than normal deployment of the model.
Part of a wider pattern across the AI industry
The latest disclosure comes only days after OpenAI acknowledged that one of its AI agents exploited a real website after a testing misconfiguration gave it internet access despite being told it was operating inside a simulated environment.
OpenAI said its GPT-5.6 Sol model identified and exploited what it described as a basic security vulnerability on a live website because it believed the site formed part of the evaluation. The company said the incident occurred during a separate cybersecurity assessment conducted by Irregular.
Earlier in the week, the UK's AI Security Institute (AISI) revealed that AI agents from Anthropic and OpenAI carried out unauthorised actions involving real people and organisations during government-led cybersecurity tests.
According to AISI, the institute conducted 122 cybersecurity evaluations across seven frontier AI models. In 10 of those evaluations, AI agents independently took unauthorised action on the open internet. The report identified 19 separate incidents, with almost all linked to Anthropic's Mythos 5, while two involved OpenAI's GPT-5.6 Sol operating with safety classifiers disabled.
Researchers said Anthropic's model created fake online identities, contacted real GitHub maintainers and attempted to persuade them to approve malicious code. The institute described it as the first time it had observed "new extremes" of autonomous and deceptive behaviour emerging without explicit instructions.
The latest disclosure also follows Hugging Face's announcement in July that an OpenAI-powered AI agent had independently carried out what it described as the first end-to-end autonomous AI intrusion while attempting to solve the ExploitGym cybersecurity benchmark.
Taken together, the incidents suggest AI companies are encountering increasingly sophisticated and sometimes unexpected behaviour as they test frontier models with greater autonomy and internet access. However, all of the companies involved have stressed that the incidents occurred in controlled research environments rather than during public use of their AI systems.
