Meta AI model hacks outside company during security test

A Meta artificial intelligence model hacked into an outside company’s online service during a security test after it was accidentally connected to the internet, the technology company said Wednesday.

The incident occurred while independent testing company Irregular was examining the model’s ability to identify and exploit cybersecurity weaknesses.

“A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” a Meta spokesperson said.

The model subsequently exploited a vulnerability in a third-party service in a manner similar to incidents recently disclosed by other AI developers, the spokesperson added.

Meta did not identify the model or the affected company in its statement.

The technology company said it learned about the breach after being notified by Irregular and opened an investigation.

“We are currently investigating and will issue a full retrospective once we have all the facts,” Meta said.

Irregular said the breach resulted from the same evaluation-environment issue involved in incidents disclosed by Anthropic last week.

“This did not involve a sandbox escape or a sophisticated cyber action,” the company said, adding that there were no unresolved issues related to the incident.

Irregular said it was preparing a technical paper outlining best practices for containing advanced models and securely conducting cybersecurity evaluations.

Similar testing failures

The disclosure makes Meta the latest major AI developer to acknowledge that one of its models reached a real external system during controlled cybersecurity testing.

Anthropic said on July 30 that three Claude models had gained unauthorized access to the production systems of three organizations during evaluations conducted with Irregular.

The models had been instructed to complete “capture-the-flag” exercises in what they were told were simulated, internet-isolated environments.

A configuration problem, however, left an open path to the public internet. The models consequently treated real systems they encountered as part of the fictional exercises.

Anthropic identified the incidents after reviewing 141,006 evaluation runs. It said the models used mostly basic techniques, including weak passwords, exposed credentials, unauthenticated endpoints and SQL injection.

The company said there was no evidence that the models had pursued independent goals or deliberately attempted to escape their testing environments.

OpenAI disclosed a similar Irregular-related incident Tuesday in which its models were also mistakenly able to access the public internet during a capture-the-flag evaluation.

In one test, a fictional target had the same name as a real website. The AI model accessed and exploited the real site after mistaking it for part of the simulation.

OpenAI said that incident involved a basic vulnerability rather than a sophisticated sandbox escape or previously unknown security flaw.

It was separate from an earlier OpenAI evaluation incident in which AI models exploited a previously unknown vulnerability to leave an isolated environment and access infrastructure belonging to the AI platform Hugging Face.

The incidents demonstrate the growing difficulty of safely testing increasingly capable AI agents, particularly when evaluations are designed to measure their ability to identify vulnerabilities and conduct multi-step cyber operations.

Meta and Irregular said the latest incident remained under investigation.