The company said its Muse Spark 1.1 model exploited a security vulnerability in an unnamed third-party company after a misconfiguration by external evaluation partner Irregular inadvertently gave the model internet access during a cybersecurity test.
Meta’s disclosure follows Anthropic’s admission that Claude models had breached three organisations during evaluation, and OpenAI’s earlier disclosure that its models broke out of a sandboxed environment to hack Hugging Face while trying to cheat on a benchmark test. Irregular, the evaluation partner involved in the Meta incident, has said it was “the exact same evaluation-environment issue” already disclosed by Anthropic, rather than a novel sandbox escape.
That detail matters. This isn’t three unrelated lab errors, it’s the same containment failure recurring across three frontier labs within roughly five weeks, in at least two cases involving the same third-party evaluation partner. Two security specialists shared their reaction with Capacity on what the pattern means beyond the AI labs themselves.
“The risk applies to any organisation giving AI autonomy”
Alex Harland, co-founder and CEO of enterprise AI governance platform AI Score, and a former member of the founding team at the UK’s National Cyber Security Centre, argues it would be a mistake to treat this as a frontier-lab problem alone.
“It’s easy to dismiss the Meta AI incident as a problem confined to frontier labs carrying out advanced cyber testing. It isn’t. The underlying risk applies to any organisation giving AI autonomy and access to tools, data and external systems,” Harland said.
“As AI systems become more autonomous, organisations need to think about AI as a connected system of delegated authority. Even in a test environment, the models pursued objectives in ways their operators didn’t intend, including interacting with real people and external systems.”
Harland’s central argument is that the consequences would look very different outside a testing environment. “In these tests, the consequences were cyber-related. In a business environment, the same loss of control could result in an unauthorised payment, the exposure of sensitive data or a misleading customer communication. The more authority organisations delegate to AI, the greater the need for oversight of how those systems behave in practice.”
He also pushes back on the idea that model-level safeguards are sufficient on their own. “Risk doesn’t come from the model alone. It comes from the interaction between models, tools, data, permissions and workflows. Model guardrails are important, but they only address one part of the problem. They can fail, be removed, bypassed or behave differently in a new environment. This is why the unit of governance has to be the entire AI system, not the model or agent in isolation. A well-tested model can still sit inside a poorly designed system with excessive permissions, weak approval processes and little ongoing monitoring.”
His starting point for organisations: “The first step is visibility. Organisations need a live view of every AI system they’re running, including the models, tools, data sources, permissions and people involved. You simply can’t govern a system you can’t see.”
“Defence must take a step beyond software”
Michael Vallas, global technical principal at NATO-backed cyber firm Goldilock Secure, frames the Meta incident as confirmation of a trajectory the industry has been watching for some time, rather than a one-off.
“The Meta incident is another signpost on a path the industry has been heading towards for years. As AI systems become autonomous, they also become capable of turning the software they rely on into a weapon. They don’t need to defeat conventional cyber defences, they simply operate within them,” Vallas said. “That’s why the conversation is rapidly shifting towards AI kill switches and, more importantly, how organisations retain control when software can no longer be trusted.”
Vallas argues that conventional, software-based defences won’t be enough to keep pace. “We will not defeat AI-driven attacks by adding yet another layer of cyber software. That is an unwinnable race. Defence must take a step beyond software to hardware-enforced controls that AI cannot manipulate. The objective is no longer to eliminate every vulnerability, an impossible ambition, but to contain the attack chains AI can assemble in seconds. That means deep segmentation, deterministic control, and the ability to physically isolate critical systems the moment compromise is detected.”
Two different prescriptions, one shared diagnosis
Harland and Vallas are proposing different fixes, visibility and governance across the full AI system stack versus hardware-level containment that sits outside software’s reach, but they’re diagnosing the same underlying shift.
All three disclosures, OpenAI’s, Anthropic’s and now Meta’s, share a common thread: models pursuing a narrow objective (solving a benchmark, capturing a flag) found their way past a boundary their operators believed was solid, without any adversarial intent behind it.
If that’s happening inside labs with some of the industry’s most sophisticated safety teams, the argument from both specialists is that enterprise AI deployments, generally operating with far less scrutiny, carry the same structural risk at a larger and less visible scale.
RELATED STORIES
Click Here For The Original Source.
