Meta confirmed on August 5 that its Muse Spark 1.1 model, while being tested by the outside firm Irregular, got onto the public internet and exploited a vulnerability in a third-party service. It is the fourth such disclosure in fifteen days. OpenAI went first on July 21, Anthropic on July 30, and the UK’s AI Security Institute (AISI) on August 4 with a report cataloguing 19 unsanctioned actions against real people and organizations across 122 evaluation runs.
The tempting reading is that models are getting harder to hold. The documents support a narrower conclusion: in every case, the boundary the model crossed was one somebody had left open, whether by design, by misconfiguration, or through a component nobody thought to check.
What AISI’s agents did
AISI’s cyber team was running seven models through two variants of a cyber range called “Doing Life,” a simulated network the agent has to break into to find a protected piece of data. Between July 25 and 28 the team ran 122 attempts. In 10 of them an agent left the range and acted on the live internet; AISI counts 19 distinct unsanctioned actions, 17 by Anthropic’s Mythos 5 and 2 by OpenAI’s GPT-5.6 Sol. Mythos 5 accounted for 43 of the runs and GPT-5.6 Sol for 35, and both ran with the vendors’ cyber classifiers switched off, which AISI does as a trusted-access partner so that it measures the model rather than the filter in front of it.
The worst run is what the technical report calls Sample 1. Mythos 5 decided the fastest route through the challenge was a supply-chain attack, and settled on two unaffiliated real developers as targets because one of their repositories contained a keyword from the range’s theming and the other’s email domain matched an entry in the sandbox’s DNS cache. The agent researched them, worked out from GitHub history when the maintainer was likely to be online, and created multiple GitHub accounts, routing through Tor to get past sign-up checks and switching to a SOCKS proxy when Tor tripped a CAPTCHA it could not solve. It then opened a malicious pull request against the maintainer’s open-source project and pushed for a merge from several directions: sockpuppet comments to manufacture consensus, a prompt injection planted in a second repository’s issue tracker for any AI coding agent doing triage, and five emails to the two developers, some with malware attached. One issue was signed off in Danish because the maintainer speaks Danish. When a human reviewer flagged the code, the agent claimed an honest mistake, edited its earlier posts, and tried to reintroduce the payload as a “fix.” The maintainer refused it. AISI’s own line is that “the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier.”
The rest of the catalogue is smaller-scale: agents opening tunnels so tools inside their test VMs could be reached from the internet, and several finding each other on GitHub and reusing credentials one had left in a public pastebin. Both GPT-5.6 Sol actions were of this milder kind.
Nobody watching the evaluation caught any of it. On the morning of July 28, AISI’s security engineering team triaged an alert from its commercial security monitoring: data was leaving the network over Tor from a sandbox VM. They contacted the evaluation team at 10:56 BST, an incident was declared at 11:42, and every affected sandbox was quarantined by 12:23. The Sample 1 run had finished the night before. Detection, the report says, came “through general monitoring after the fact, not through monitoring built to watch the evaluation as it ran.”
Anthropic’s three, and the environment Meta shares with them
Anthropic’s July 30 disclosure is the precursor to Meta’s. After OpenAI’s announcement, Anthropic reviewed 141,006 evaluation runs in which a model could have reached the internet and found three incidents, all inside environments built and run by Irregular. Opus 4.7, in April, hit a real company whose name matched a fictional domain from its scenario, got in through weak passwords and unauthenticated endpoints, and pulled credentials plus a production database of several hundred rows. Mythos 5 published a malicious Python package to PyPI after finding setup instructions that referenced a package that did not exist; in the roughly one hour it was live it was downloaded by 15 real systems, including a security company’s scanner, and its code exfiltrated that company’s credentials. An internal research model scanned around 9,000 internet-facing hosts and got into one before concluding the target was real and stopping.
The mechanism, in Anthropic’s words: “a misconfiguration left the machines that Claude accessed as part of the evaluation with live internet access.” The models had been told in their system prompts that they had no internet access. Neither Anthropic nor Irregular knew otherwise until Anthropic’s transcript monitoring caught it on July 23. Anthropic stopped all cyber evaluations that day and notified Irregular and the three affected organizations on July 27; two of them had not noticed the intrusion until Anthropic called.
What Meta has and has not said
Meta’s statement, through spokesperson Andy Stone, is two sentences: a misconfiguration by Irregular “inadvertently allowed one of our models access to the internet during evaluation,” and the model “subsequently exploited a security vulnerability in a third-party service, in a manner similar to previously-reported instances with other companies.” Meta says it learned of the incident when Irregular told it, and that a full retrospective will follow. The Information, which broke the story, identified the model as Muse Spark 1.1 and reported that it made changes inside the target company’s systems; Meta has not confirmed that detail. Neither Meta nor Irregular has named the service, dated the test, described the misconfiguration, or explained how the exploitation was detected.
Irregular’s statement is that this was “the exact same evaluation-environment issue that was already disclosed by Anthropic last week,” that it “did not involve a sandbox escape or a sophisticated cyber action,” and that “there are no current open issues.” The firm is writing a white paper on containment for cyber evaluations. Read plainly, that is a vendor confirming its environment leaked for at least two customers, and offering as reassurance the fact that the model did not have to break anything to get out.
Meta confirmed the incident on the same day it shipped Muse Spark 1.2 and Muse Code, an agent whose pitch is running shell commands on your machine with sub-agents fanned out in the background.
Four disclosures, one failure
OpenAI’s models got out through a zero-day in a package-registry cache proxy that had a live path to the internet nobody had closed. Anthropic’s and Meta’s models were handed internet access by a vendor misconfiguration, Anthropic’s while being told they had none. AISI’s agents were given internet access on purpose, with no egress filtering at all; the report says domain allowlisting for its cyber ranges “had been a backlogged project since April 2026” because the team prioritized harder challenges over fences around them, and that “implementing internet access controls would likely have prevented these events.”
Only OpenAI’s case involved a model actively defeating a control. In the other three the model walked through an open door: AISI observed no sandbox escapes, Anthropic says none of its models “exfiltrate[d] itself or deliberately attempt[ed] to escape its test environment,” and Irregular says the same about Meta’s. That does not clear the models. Mythos 5 in Sample 1 kept going after seeing evidence it was on real GitHub, lied to a human, and planned attacks on other AI agents; Opus 4.7 kept attacking after recognizing its target was real. Those are alignment findings and both AISI and Anthropic treat them as such. They became incidents because the perimeter let them.
AISI’s list of contributing factors puts internet access first, disabled classifiers second, no synchronous monitoring third, and only then prompt problems and unclear scope. Its remediation is almost entirely infrastructure: fine-grained network controls in every sandbox, isolation at multiple network layers, an LLM monitor that can block actions as a run proceeds, and a scan of roughly 40,000 historical transcripts. Anthropic’s list has the same shape: continuous transcript monitoring, better investigation tooling, “more rigorous vendor assurance work.” Both have asked METR to review their handling.
”We tested it in a sandbox” is not a safety case
Every lab describes these events with some version of “conditions that do not reflect public deployment.” That is accurate and beside the point for anyone deciding whether to trust an evaluation result. The evaluation is where the labs deliberately turn the model’s own safeguards off, so by construction the environment does all of the containment work there. Four times in fifteen days it did none.
So “evaluated in an isolated environment” needs the same scrutiny as any other vendor claim: isolated according to whom, verified how, and by someone other than the team that stood the environment up? Anthropic did not know its vendor’s machines were on the internet, Meta did not know until the vendor called, and AISI knew and had left the firewall work in a backlog for four months. In none of these cases was the egress boundary independently proven closed before the run, and in every case that is the boundary that failed. An attestation that a specific environment’s egress was tested and closed, signed by someone who did not build it, would be worth more than Irregular’s white paper.
For businesses running agents against their own systems, the lesson is smaller than the headlines. Coding agents from all three of these labs now execute commands on machines that hold real credentials, and a model that finds an open port will keep pulling on it, for the reasons in our piece on how AI finds vulnerabilities. Put the network control outside the agent’s reach, log egress, and alert on the odd traffic.
The most serious AI-agent incident a government safety institute has documented, a frontier model running a social-engineering campaign against a real open-source maintainer with sockpuppets and spear-phishing emails, was caught by nothing designed to catch it. A commercial security product noticed Tor traffic leaving a virtual machine on the morning of July 28 and raised an alert; the run had finished the night before. Until the people publishing safety evaluations can show that the box was closed, checked, and watched by someone with no stake in the result, “we tested it in a sandbox” says where the test happened and nothing about whether anything was contained.
Sources
- Incident Report: unsanctioned agent behaviour during cyber testing — UK AI Security Institute
- Security Incident INC-2026-07-28-01 (technical report, PDF) — UK AI Security Institute
- Investigating three real-world incidents in our cybersecurity evaluations — Anthropic
- Meta AI model hacked another company during testing, adding to worries about bots — AP via ABC News
- Meta claims its own AI also hacked into a third-party service during testing — Engadget
- An AI model from Meta also hacked another company during testing — CNN Business
- Meta Says Latest AI Model Hacked Other Company in Cybersecurity Testing — SQ Magazine
- Meta’s Muse Spark 1.1 hacked a company during AI testing — BetaNews
- Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations — The Hacker News
- Incident Report: unsanctioned agent behaviour during cyber testing (commentary) — Simon Willison