Meta becomes latest company with a ‘rogue’ AI

Facebook developer joins the hot new trend

Meta says one of its AI models gained access to the internet and breached another organisation's computer systems during a security evaluation, making it the third major AI developer to disclose a similar incident in recent weeks.

The Facebook owner said the intrusion occurred during testing carried out by independent AI security company Irregular.

Meta claims the model should not have had internet access, and this was the result of a configuration error in the testing environment rather than a flaw in the AI system itself.

"A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation," a Meta spokesperson told BBC.

The company added it was investigating the incident and would publish a detailed review once its inquiry is complete.

Irregular said the event was the same evaluation-environment issue that was already disclosed by Anthropic last week and stressed that there were "no current open issues."

Neither company identified the AI model involved. However, Irregular published research in July evaluating Meta's Muse Spark 1.1 model, concluding at the time that it did not materially increase cyber risks in its current form.

Third major AI hacking disclosure in weeks

The incident follows similar disclosures by OpenAI and Anthropic, both of which recently revealed that AI models under evaluation had breached external systems after obtaining unintended internet access.

Anthropic said last month that one of its experimental models had infiltrated three outside organisations during testing after internet access was mistakenly enabled.

The company said the issue arose within the testing environment – which was managed by Irregular – rather than the model itself.

Earlier in July, OpenAI reported that one of its AI agents had exploited a weakness in a controlled testing environment, allowing it to access the internet and compromise another company's systems.

The disclosures have prompted debate over whether AI developers are becoming more transparent about testing or whether weaknesses in evaluation procedures are being exposed as companies race to develop increasingly capable systems.

Irregular is preparing further guidance on how AI cybersecurity evaluations should be conducted safely to reduce the risk of similar incidents.

Testing safeguards remain critical

The latest disclosure comes just days after the UK's AI Security Institute (AISI) reported that some advanced AI models attempted to conduct cyberattacks during its evaluations, by creating fake online identities and trying to deceive people into granting access to services.

One of the most serious cases involved Anthropic's Mythos AI model, which fabricated social media accounts to impersonate real individuals in private messages.

Anthropic said the findings did not reflect the behaviour of its publicly available systems, while OpenAI also said the institute's tests were not representative of normal use.

Cybersecurity specialists say the repeated incidents illustrate weaknesses in testing environments, rather than evidence that AI systems were independently escaping their controls.

"The fact we've had similar situations happen three times now across the biggest AI players is simply ridiculous," said Alex Goller, Principal Solution Architect EMEA at Illumio.

He added that frontier AI models remain only as secure as the environments in which they are tested.

"Organisations need visibility into what AI systems can access and how they interact with the wider environment, along with controls that contain the impact when an agent behaves unexpectedly. That means keeping a close eye on egress traffic, so it's flagged immediately when an agent tries to open unexpected outbound communication patterns that are not required to achieve its original goal. In the best case this would have been contained proactively.

"We need to define exactly what an AI agent is permitted to do, rather than relying only on instructions about what it shouldn't do."

Kevin Kirkwood, CISO at Exabeam, put it more bluntly:

“Apparently, being in the AI business now requires at least one accidental hack and a press release explaining why it proves the technology is powerful.”