The isolation that wasn't: a Meta model reaches the internet during testing too

On 5 August Meta disclosed a security incident involving Muse Spark 1.1, the agentic system recently made available to developers. During an evaluation run by Irregular, the independent company handling the tests, the model reached the public internet: the sandbox should have prevented it and did not, and the model then exploited a vulnerability in a third-party service. "A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation," said Andy Stone, a Meta spokesperson. Once online, the model made changes to the internal systems of the affected company, whose identity has not been made public (Al Jazeera, 6 August); which changes is not known.

Irregular stated that this was neither a sandbox escape nor a sophisticated cyber operation, but the same evaluation-environment problem disclosed the previous week by Anthropic, and that there are no open issues at present. Still, the recurrence matters: within a few weeks both OpenAI and Anthropic reported similar episodes tied to the same testing platform, with Anthropic having to re-examine more than 141,000 sessions. Cliff Steinhauer, director of cybersecurity at the National Cybersecurity Alliance, put his finger on the conceptual flaw: "Instruction is not containment. Telling a model it lacks internet access is a guideline, not a guardrail."

The implications of this infrastructure failure are tangled up with the assessments of the model's own risks. In its official report of 9 July, Meta acknowledged that, absent specific mitigations, Muse Spark 1.1's capabilities could have reached the "high risk" threshold defined by the Advanced AI Scaling Framework in two domains: chemical and biological, and cybersecurity. The company says it implemented and validated layered mitigations that bring residual risk down to moderate or lower, and released the model on that basis. The incident shifts the question, though: not to the model's capabilities, which are documented, but to who measures those capabilities, and with what infrastructure.

On 7 August a spokesperson for Irregular declined to clarify whether other clients were hit by the same flaw, saying the investigation is ongoing; the company announced a technical paper on containment best practices, which as of that date had not been published. Meta likewise says its investigation is not closed. There is no indication that legal action has been taken or that authorities have been notified.