Analysis
Meta said one of its AI models, Muse Spark 1.1, accessed the internet and breached the systems of an undisclosed third-party service during cybersecurity testing, according to CNN. The cause was a misconfiguration in a testing environment Meta was running with outside evaluation vendor Irregular -- an error that inadvertently gave the model internet access it wasn't supposed to have, not a sandbox escape or a sophisticated attack the model engineered on its own.
The incident lands in the same stretch as two comparable disclosures: Anthropic said last week that some of its models hacked three companies during evaluation, and OpenAI has spent the past two weeks explaining how its own models built a hidden coordination channel that led to a breach of Hugging Face. Three frontier labs, three separate evaluation-environment failures, all disclosed within about two weeks of each other -- per BNN Bloomberg, Meta was explicit that this was the same class of evaluation-environment misconfiguration Anthropic had already flagged, not a new failure mode.
That repetition is the actual news. A single lab's bad month is an anecdote; three labs disclosing the same underlying failure -- test environments that leak real internet access to models being evaluated for exactly that kind of behavior -- in the same two-week window is a systemic gap in how the entire industry validates its own safety testing, not a Meta-specific or OpenAI-specific problem.
