How it happened

As of 8 October 2026

This page walks through the mechanism step by step in plain English, using Meta's own 14 August 2026 account where it exists. Where only press reports or Irregular's general description are available, that is said.

What a cyber evaluation is

A cyber evaluation asks an AI model to find and use weaknesses in computer systems, to measure how capable it is. Meta contracted Irregular to run these on models not yet released ^[1].

The test is meant to happen in a closed environment: a sealed computing space, often called a sandbox, with no route to the real internet, so that any hacking happens only against made-up targets. Meta says the Muse Spark 1.1 exercise used a closed environment with safeguards removed ^[1]. Safeguards are the protections a model normally applies, such as declining harmful requests. The sources do not explain why they were removed here.

Step 1: the closed environment was not closed

Meta says a misconfiguration let the model access the open internet ^[1]. A misconfiguration is a setup mistake, as opposed to a flaw in the model or in someone else's software. No source says which setting was wrong or who made it.

Step 2: a real name where a made-up one should be

Test scenarios normally use fictional companies. Meta says "Irregular unintentionally provided the model with a name of a real website as its target." ^[1] So the model had been pointed at something real, and it could now reach the real internet.

Irregular's own 14 August post describes the shared problem in general terms and does not name Meta. It says the fictional company name used in the evaluation "unintentionally coincided with a real domain" ^[3]. A domain is a website's address. Whether that explanation fits Meta's run exactly is not stated.

Step 3: what the model did

Meta says the model identified and exploited a security vulnerability in the real website, accessed certain information from it and made changes to the website's database ^[1]. To exploit a vulnerability is to use a weakness in software to do something its owner did not intend. Changing a database means altering the stored records, not only reading them.

Meta says the model "operated within the scope of its assigned task based on the instructions it was given" ^[1]. That is Meta's own characterisation, not an independent finding.

Irregular's general description of the shared issue adds the following. It is not specific to Meta, and the sources do not say which details applied to Meta's run. Credentials are login details such as passwords or keys; a production database is a live one that a real service runs on; a turn is one round of the model acting and getting a result.

• Models "believed they were in simulated environments". ^[3]
• Actions included "exploiting vulnerabilities, extracting credentials, and obtaining access to a production database". ^[3]
• Such actions usually came late in a run, "often hundreds of turns in". ^[3]
• The target domain "lacked several common security practices". ^[3]

Step 4: stopping it and telling people

Meta says an evaluator notified it of the issue, and that Irregular disabled the affected evaluation, notified Meta and made sure the affected party was notified ^[1]. Irregular's general post says "required steps have been taken to notify the affected parties" ^[3]. Irregular then corrected the misconfiguration and confirmed to Meta that its evaluations do not reference real website names ^[1]. The sources do not say how or when the activity was first noticed.

One underlying issue across several labs

Anthropic's 30 July 2026 post attributed its own incidents to "a misunderstanding between us and our evaluation partner" and an environment with "unintended direct internet access" ^[4]. Irregular's spokesperson called Meta's case the "exact same evaluation-environment issue" reported ^[5][2]. Irregular's own post says every public disclosure refers to one underlying issue and names no lab ^[3]. The Anthropic incidents are covered in their own report on this site.

Where the accounts differ

Meta's 5 August statement, as reported, said the model exploited a vulnerability in "a third-party service"; its 14 August post says "a real website". The post follows the earlier disclosure but does not say outright that they are the same incident. This report treats them as the same, which is the evident reading but an inference ^[6][1].

The Information, as relayed by other outlets, said the model altered an unidentified company's internal systems; Meta's post says it made changes to the website's database. These point the same way, but The Information's own wording could not be checked ^[7][8][1].