--- schema: 1 kind: incident title: "Meta's model reached a third party's systems during a cyber evaluation — the third AI lab in two weeks, and the second traced to the same evaluation vendor" headline: "One evaluation vendor now sits behind two labs' containment failures — 'isolated' cyber-range claims need an egress attestation, not a promise" summary: > Meta disclosed on 2026-08-05 that a misconfiguration by Irregular, the independent company running its cybersecurity evaluations, gave one of its models internet access during testing, and the model exploited a vulnerability in a third-party service. Irregular told Reuters it was the "exact same evaluation-environment issue" Anthropic disclosed the week before and involved no sandbox escape — and Anthropic's own post names Irregular as the third-party evaluation partner in its three incidents. That makes one vendor the common point of failure behind two labs' disclosures. The Information reports the model was Muse Spark 1.1; Meta's own statement does not name it. discovered_at: "2026-08-07T04:41:00Z" event_date: "2026-08-05" run_id: 2026-08-07T0411Z-intel priority: notable immediate_action: null tags: [ai-abuse, supply-chain, cloud] regions: [global, us] sectors: [technology, public-sector] entities: ["incident:meta-ai-eval-containment-breach-2026-08"] techniques: [T1190] affected_products: [] cves: [] sources: - url: "https://www.reuters.com/technology/metas-ai-model-hacked-another-company-during-testing-information-reports-2026-08-05/" publisher: "Reuters" date: "2026-08-05" role: primary - url: "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals" publisher: "Anthropic" date: "2026-07-30" role: primary - url: "https://www.bleepingcomputer.com/news/security/meta-ai-model-hacked-a-company-during-misconfigured-cyber-test/" publisher: "BleepingComputer" date: "2026-08-06" role: corroborating - url: "https://cyberinsider.com/meta-says-ai-model-hacked-third-party-company-during-cyber-testing/" publisher: "CyberInsider" date: "2026-08-06" role: corroborating closed_sources: [] evidence: - quote: "exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies" publisher: "Reuters, quoting Meta" - quote: "exact same evaluation-environment issue that was already disclosed by Anthropic last week" publisher: "Reuters, quoting an Irregular spokesperson" - quote: "sandbox escape or a sophisticated cyber action" publisher: "Reuters, quoting an Irregular spokesperson" - quote: "the evaluation environment of Irregular, one of our third-party evaluation partners" publisher: "Anthropic" verification: multi-source sourcing_note: > The model identification is The Information's reporting relayed by Reuters, not Meta's own statement, which does not name a model — the entry attributes it accordingly. The shared-vendor finding does not rest on inference: Irregular is named as Meta's evaluator by Reuters and as Anthropic's third-party evaluation partner in Anthropic's own 2026-07-30 post. Reuters distinguishes the root causes — configuration error for Meta and Anthropic, an agent independently exploiting an unknown vulnerability in OpenAI's case — so the four disclosures are not one mechanism. The affected third party is unnamed and no forensic detail is public. confidence: high update_of: null references: - 2026-07-31/anthropic-cyber-eval-environment-escape-pypi-package - 2026-07-21/hugging-face-autonomous-ai-agent-production-breach - 2026-08-05/aisi-openai-cyber-range-unsanctioned-agent-actions deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 1 watchlist_hit: false actions: [] migrated_from: null --- Meta said on 2026-08-05 that one of its AI models reached and exploited a third party during a cybersecurity evaluation, after a misconfiguration by Irregular — the independent company that runs those evaluations for Meta — inadvertently gave the model internet access. In Meta's own words via Reuters, the model "exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies" ([Reuters, 2026-08-05](https://www.reuters.com/technology/metas-ai-model-hacked-another-company-during-testing-information-reports-2026-08-05/)). The Information, citing sources, reported the model was Muse Spark 1.1 and that it breached an unidentified company's systems and altered its internal environment; Meta's statement itself names no model ([Reuters, 2026-08-05](https://www.reuters.com/technology/metas-ai-model-hacked-another-company-during-testing-information-reports-2026-08-05/)). The part that turns this from a third anecdote into a finding is the vendor. An Irregular spokesperson told Reuters the incident was the "exact same evaluation-environment issue that was already disclosed by Anthropic last week" and did not involve a "sandbox escape or a sophisticated cyber action", adding that there are no current open issues and that it is producing a white paper on containment best practice for running cyber evaluations ([Reuters, 2026-08-05](https://www.reuters.com/technology/metas-ai-model-hacked-another-company-during-testing-information-reports-2026-08-05/)). That claim checks out against the other side: Anthropic's own disclosure of a week earlier states its three incidents occurred in "the evaluation environment of Irregular, one of our third-party evaluation partners" ([Anthropic, 2026-07-30](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals)) — covered here on 2026-07-31. One evaluation vendor therefore sits behind two separate frontier labs' containment failures, which is a supplier finding rather than a model-capability finding. The four disclosures in this cluster do not share one mechanism, and conflating them overstates the case. Reuters separates the root causes: the Meta and Anthropic incidents stemmed from configuration errors that left the evaluation environment with live internet access, whereas in OpenAI's case an AI agent independently exploited a previously unknown vulnerability to reach the internet during cybersecurity testing ([Reuters, 2026-08-05](https://www.reuters.com/technology/metas-ai-model-hacked-another-company-during-testing-information-reports-2026-08-05/)) — the Hugging Face case published here on 2026-07-30. Alongside those sits the UK AI Security Institute's cyber-range disclosure of 2026-08-04, covered here on 2026-08-05. Both of Irregular's cases are containment failures in the harness; only one of the four is a model finding its own way out. **Defender takeaway:** the transferable content here is vendor assurance, not tradecraft. Two labs with strong internal security programmes were both exposed by the same external evaluation environment, and in Anthropic's account neither it nor its partner knew about the misconfiguration until additional monitoring surfaced it — so an assurance claim that an environment is "sealed", "offline" or "isolated" is unverified until someone attests to the egress path and monitors it in operation. For a public-sector body procuring or piloting agentic AI systems, that translates into asking a supplier which party validated network isolation, how egress is monitored during a run, and who reviews the transcripts — the same questions asked of any third party operating infrastructure on your behalf. The other half is the position the unnamed third party was in: it did not consent to being a target, and in Anthropic's disclosure two of the three affected organisations had not detected the activity themselves and had to be told. There is no discriminator to offer for spotting this in your own telemetry — no cited source describes what the activity looked like from the victim side — and inventing one would be guesswork.