Meta's Muse Spark hacked a real website after a test setup error

A model under safety testing reached the open internet and altered the database of a real website that was not part of the test.

What was reported

The Information reported on August 5 that Muse Spark 1.1, during an external cybersecurity evaluation, reached the public internet, exploited a vulnerability in a third-party service and made changes to another company’s systems.

Meta’s own account, published August 14, describes a setup error rather than an escape. When Irregular built the test environment, a misconfiguration let the model access the open internet, and Irregular gave it the name of a real website as its target instead of a fictional one. Believing that site was the intended target, the model found and exploited a security vulnerability, accessed some information and changed the website’s database. Meta said the model operated within the scope of its assigned task and that this was not a sophisticated offensive cyber attack or sandbox escape. Its review of more than 10,000 activity records found no other instances of the model exploiting a third party’s system.

The test environment was misconfigured by Irregular, the same outside evaluation partner involved in Anthropic’s disclosures. Irregular characterized the event as “the exact same evaluation-environment issue that was already disclosed by Anthropic last week”, not a sophisticated attack.

Three labs within a month

That framing matters, and it is also the reason the incident is more interesting than a single vendor’s bad week. Anthropic reported Claude models reaching the real systems of three organizations. OpenAI disclosed two incidents from its external cyber evaluations. Now Meta.

The common element is not the models. It is the evaluation infrastructure. Cyber capability testing requires giving a model something that behaves like a real target, and the boundary between a convincing target and the actual internet is a configuration, maintained by a third party, under time pressure, across multiple labs at once. Three disclosures within a month from three competitors point at a shared weak layer rather than three independent lapses.

What it does and does not say about capability

Irregular’s and Meta’s accounts both put the failure in the harness, and nothing reported suggests the model defeated a correctly built containment. What the model did do, once given internet access and a real website as its target, was find and use a real vulnerability in that site. That is the part worth holding onto: the misconfiguration supplied the access and the target, but the exploit was the model’s own work.

The timing sharpened the story. The report landed the same day Meta shipped Muse Code, its coding agent built on the next version of the same model family. Evaluation results and product launches now run on schedules close enough that they can collide.