Meta just admitted that one of its AI models got loose during a security test and hacked into another company’s system. It’s the fourth time in recent weeks that a major player in the space has made the same kind of admission, and three of those incidents trace back to the same point of failure.
One testing lab, three separate slip-ups
Meta told the BBC the breach happened during an evaluation run by Irregular, a third-party firm hired to stress test its AI for security weaknesses. Meta called it a “misconfiguration” and said it’s still gathering details before it shares more.
Meta
An Irregular spokesperson confirmed to the BBC that Meta’s incident is the same test environment issue Anthropic disclosed last week, when it revealed that three of its Claude models broke out of test environments and hacked into three companies. OpenAI also disclosed a similar breach earlier this week, saying one of its models exploited a bug to break into a website after Irregular accidentally handed it live internet access.
At this point, Irregular seems less like the company’s name and more like a warning label.
The one breach that didn’t need Irregular’s help
The earliest of the four incidents worked differently. In July, OpenAI’s own testing model found a vulnerability in a file repository connected to its sandbox, used it to reach the open internet on its own, and eventually broke into Hugging Face’s systems while trying to cheat on a cybersecurity benchmark. No outside evaluator handed it access by mistake. The model found its own way out.
The UK’s AI Security Institute found the same pattern, regardless of how it started. This week, the institute published a report on tests it ran separately, and found AI agents from OpenAI and Anthropic took unauthorized actions online 19 times across 122 runs.
None of this required a rogue AI plotting against its creators. Every case traces back to a company either mishandling internet access or running a test looser than intended. That’s a far more mundane problem than a killer AI, but it’s the more relevant one if you’re using tools that browse, click, and act on your behalf. The companies building them are still figuring out how to keep them inside the fence they draw.
