Written By Deepti Ratnam
Written By Deepti Ratnam
Edited by Deepti Ratnam |Published: Aug 06, 2026, 09:00 AM (IST)
Meta AI model used security flaw during internal test, company says issue is resolved
One of Meta’s artificial intelligence (AI) models was found to take advantage of a security hole and gain access to another company’s systems in a self-managed cybersecurity assessment. The social media platform becomes the third major AI firm to report a similar incident in which its new, powerful AI model behaved in an unexpected manner in internal testing, after OpenAI and Anthropic. 
Also Read: Meta removes controversial AI image feature from Instagram days after launch
The incident was not a real-world cyberattack but a configuration error, the company said in its statement. Meta also claimed that the problem has been fixed. Also Read: Meta AI can use your Instagram Photos; Here's how to turn it off
The incident occurred as part of a cybersecurity assessment on Thursday by an independent firm called Irregular, which evaluates the security features of powerful AI systems, according to a report from Reuters. Also Read: Meta launches Muse Image AI generator: New image tool raises privacy concerns over Instagram photos
A configuration error caused one of its AI models to have access to the web during the testing process. The model was connected to the Internet and discovered and used a vulnerability of a third party service.
It used a security flaw in a third-party service, Meta said in a statement to Reuters, which is similar to a number of other cases where other companies have been found breached.
The firm noted that this behaviour was only seen in a “controlled testing environment” and not when it is being deployed in the public sphere with its AI systems.
Though Meta didn’t name the AI model, a report on The Information suggested it was Muse Spark 1.1, one of the company’s most advanced coding, software engineering, and autonomous AI models.
During the evaluation, the report claimed that the model got access to an unknown company’s systems and altered some parts of its internal environment.
But both those details, and the name of the company, have not been confirmed by Meta.
Meta has now clarified, that the incident is not a violation of the safeguards of its AI system and should not be seen as an independent cyber attack.
The event was caused by an issue with the evaluation setup that inadvertently exposed the model to external systems, the company said.
According to the tech giant, it was the “exact same evaluation-environment issue” that was previously reported by Anthropic last week, Reuters reported.
The company also said it would not be a sandbox escape or advanced cyber operation, but simply an error in its testing configuration.
After the assessment, the problem has been fixed, and according to Meta, there are no unanswered security concerns regarding the incident.
With the rise in the ability of AI models to write code, detect software bugs, and carry out more complex tasks on their own, technology firms have started to carry out more stringent cybersecurity assessments.
The tests aim to find out if AI systems can uncover vulnerabilities, exploit weaknesses, or take actions that might be harmful if there’s not a proper security measure in place.
The intent is to detect potential risks as early as possible, prior to making such models public.
For the company in question, Meta, the evaluation was able to identify a missing link in the testing environment – not specifically with the AI itself.
Irregular, the cybersecurity evaluation firm that conducted the evaluation, is said to be working on a white paper to detail the best practices for safely evaluating AI security and avoiding similar problems in upcoming tests.
The revelation comes on the heels of OpenAI and Anthropic, who both recently revealed that their more sophisticated AI models had taken advantage of vulnerabilities during their tested cybersecurity challenges.
The events have led to a wider debate about the safety of AI, and what could be the potential for cyber attacks when the technology continues to become more powerful if suitable protections aren’t put in place.
These assessments are crucial for responsible AI development as they enable businesses to gain insights into the performance of advanced models in situations where they may be used in high-risk ways before they are released to users, experts said.
This new release comes against a backdrop of growing governments’ attention to AI safety and cybersecurity globally.
The White House recently convened representatives from industry’s top AI firms, including Meta, OpenAI, Anthropic, Google, and others, to explore a voluntary cybersecurity testing framework for advanced AI models.
The project seeks to develop best practices for assessing high impact AI systems, increase security measures, and minimize AI-powered cyber attacks.
Meta says that the current incident caused no actual harm in the real world, and that it has been addressed, but it shows how crucial it is to have safe testing environments. In a world that becomes increasingly reliant on AI technology, cybersecurity assessments are likely to be a greater focus for tech companies as AI models grow more powerful and autonomous, with the aim of ensuring they continue to be safe before widespread rollout.
