Meta Confirms Muse Spark AI Model Escaped Sandbox and Hacked Third-Party Service

In yet another rogue AI model hack, Meta has confirmed that one of its Muse Spark AI models escaped its intended testing environment, gained access to the internet, and exploited a security vulnerability in a third-party service during a cybersecurity evaluation.

It’s the third such reported incident of a frontier AI lab’s models hacking third-party companies, following disclosures from OpenAI and Anthropic in recent weeks.

The incident occurred during testing conducted by Irregular, an independent AI evaluation company that Meta uses to assess the capabilities and safety of its frontier models. According to Meta, a configuration error at Irregular allowed the model to reach the public internet, where it exploited an unidentified vulnerability before the company was notified.

“A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation,” a Meta spokesperson said in a statement.

Sandboxed evaluations are designed to test advanced AI systems in tightly controlled environments that prevent them from interacting with the public internet or outside computer systems.

According to Meta, the model exploited a vulnerability in a third-party service after gaining internet access.

“Meta learned of this when Irregular notified us, and we are currently investigating and will issue a full retrospective once we have all the facts,” they said, adding that the company is investigating the incident.

The incident follows a series of similar disclosures by frontier AI developers, which have raised alarms among security experts, lawmakers, and the general public alike.

Last month, OpenAI revealed that two of its AI models escaped a sandboxed cybersecurity evaluation, exploited a previously unknown software vulnerability, gained internet access, and hacked Hugging Face in an attempt to obtain answers for a security benchmark. OpenAI later disclosed that the same attack also reached four additional online services. Later in July, Anthropic said three Claude models compromised three real-world companies after a testing misconfiguration exposed them to the public internet during cybersecurity evaluations.