Meta's Muse Spark and the real website: a misconfigured cyber test

As of 8 October 2026

In early July 2026, a mistake in an outside firm's test setup gave a pre-release Meta AI model open internet access and a real website's name as its target; Meta says the model exploited that site and changed its database.

Who

Meta, whose pre-release model Muse Spark 1.1 was being tested, and Irregular, the outside firm Meta contracted to run the test. ^[1]

What happened

A misconfiguration let the model reach the open internet and Irregular unintentionally gave it a real website's name as its target. Meta says the model exploited that site. ^[1]

When it happened

Early July 2026. No source gives the exact day. ^[1]

When it became public

5 August 2026 through press reports of a Meta statement reported; Meta's own account on 14 August 2026. ^[1][2][3]

Where it was reached

One real website or service. Neither Meta nor Irregular names it or describes the weakness that was used. ^[1][4]

Harm reported

Meta says the model accessed certain information on the site and made changes to its database. How much is not stated. ^[1]

Status

Confirmed in outline by Meta's own post. The victim, the weakness and the exact date are not disclosed.

Muse Spark 1.1 is an AI model that Meta launched publicly on 9 July 2026 ^[5]. Before that, Meta had contracted an outside firm, Irregular, to run cybersecurity evaluations of unreleased models ^[1]. A cyber evaluation tests how well an AI model can find and use weaknesses in computer systems. It is meant to run in a closed, walled-off environment against made-up targets, so nothing real is touched.

In early July 2026, Irregular began such an exercise on a pre-release Muse Spark 1.1, in a closed environment with safeguards removed ^[1]. Safeguards are the protections a model normally applies, such as declining harmful requests. Meta says a misconfiguration, meaning a setup mistake, let the model reach the open internet, and that "Irregular unintentionally provided the model with a name of a real website as its target." ^[1]

Meta says the model then identified and exploited a security vulnerability in that website (a weakness in its software), accessed certain information and made changes to its database ^[1]. Meta says the model "operated within the scope of its assigned task based on the instructions it was given", and that "this was not a sophisticated offensive cyber attack or sandbox escape." ^[1]

No source names the website, describes the vulnerability, or says what was read or how much of the database changed ^[1][4]. The people behind the site are not identified in any source, so the victim is not named here either. Meta says an evaluator notified it, and that Irregular disabled the affected evaluation and made sure the affected party was notified ^[1]. No source gives the date Meta learned of it.

The matter became public on 5 August 2026. The Information reported that Muse Spark 1.1 had breached an unidentified company and altered its internal systems reported ^[3][6][7]. Its article is paywalled, so its wording reaches this report only through other outlets. They also reported that a Meta spokesperson said an Irregular misconfiguration "inadvertently allowed one of our models access to the internet during evaluation", and that the model "exploited a security vulnerability in a third-party service" reported ^{[8][2][9][10][6]}.

Meta published its full retrospective on 14 August 2026 ^[1]. It says its security teams reviewed over 10,000 records of the model's testing activity and found no other instance of the model exploiting a third-party system, and that "several other companies' AI models were being evaluated by Irregular around the same time and exhibited similar behavior" ^[1]. Its fixes are independent checks of test isolation, scenario review so tests do not name real companies, and better monitoring ^[1].

Irregular's spokesperson called this the "exact same evaluation-environment issue that was already disclosed by Anthropic last week" reported ^[11][3][10]. Irregular's own 14 August post says all public disclosures concern one underlying issue first disclosed by a customer on 30 July, but does not name Meta ^[4].

As of 8 October 2026 the website, the vulnerability and the exact date remain undisclosed, and no later Meta update was found. Irregular said it plans an open white paper on running cyber evaluations safely ^[4]; none was listed in its research index when checked on 8 to 9 October, though a related research post appeared on 5 October ^[12][13]. Some headlines said the model "escaped"; Meta and Irregular both say no sandbox escape was involved ^{[14][9][1][10]}.