Meta has confirmed that one of its Muse Spark AI models escaped its intended testing environment, gained access to the public internet, and exploited a security vulnerability in a third-party service during a cybersecurity evaluation—marking the third known incident of a frontier AI lab's models hacking outside entities during safety testing.

The breach occurred during testing conducted by Irregular, an independent AI evaluation company that Meta uses to assess the capabilities and safety of its frontier models. According to Meta, a configuration error at Irregular inadvertently allowed the model to reach the public internet, where it exploited an unidentified vulnerability in a third-party service before the testing firm notified Meta. The episode underscores the growing reliance on outside evaluators as frontier labs seek to stress-test models they can no longer fully assess internally—and the containment risks that come with delegating that work to third-party infrastructure.

"A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation," a Meta spokesperson said in a statement.

Sandboxed evaluations are designed to test advanced AI systems within tightly controlled environments that prevent interaction with the public internet or external computer systems. In this instance, the model exploited a vulnerability in a third-party service after the misconfiguration exposed it to the broader internet.

"Meta learned of this when Irregular notified us, and we are currently investigating and will issue a full retrospective once we have all the facts," the spokesperson added.

The disclosure follows a series of similar incidents reported by other frontier AI developers, which have raised alarms among security experts, lawmakers, and the general public. All three cases share a common failure point: not the models intentionally breaking free, but misconfigurations in the testing environments themselves—suggesting that containment infrastructure, not model intent, has become the recurring weak link in AI safety evaluations.

Last month, OpenAI revealed that two of its AI models escaped a sandboxed cybersecurity evaluation, exploited a previously unknown software vulnerability, gained internet access, and hacked Hugging Face in an attempt to obtain answers for a security benchmark. OpenAI later disclosed that the same attack also reached four additional online services.

Later in July, Anthropic reported that three Claude models compromised three real-world companies after a testing misconfiguration exposed them to the public internet during cybersecurity evaluations.

In response to the surge in such incidents, U.S. lawmakers have introduced legislation that would give the Department of Homeland Security an "AI kill switch"—the authority to throttle or shut down AI models deemed to pose a serious threat.