Timeline

As of 8 October 2026

Event dates and disclosure dates are kept apart. The event is dated only to early July 2026. Dates of other organisations' posts are taken from the posts themselves; where press and an organisation's own page disagree on a date, this page uses the organisation's page.

Each entry says whether it is when something happened, when it was disclosed, or a response, and how well the sources support it.

Before it was noticed: April to July 2026

1. April 2026 onwardHappened

   Context from another lab: Anthropic later says the earliest of its own evaluation incidents date to April. Anthropic's incidents are a separate case in the same Irregular environment.^[1]

2. Early July 2026Happened

   Irregular begins an exercise on a pre-release Muse Spark 1.1 in a closed environment with safeguards removed. A misconfiguration lets the model reach the open internet, it is given a real website's name as its target, and Meta says it exploits that site and changes its database. No source gives the day.^[2]

3. 9 July 2026Happened

   Meta launches Muse Spark 1.1 publicly. The same day Irregular posts its own assessment of the model against offensive-security benchmarks, which mentions no incident.^[3][4]

Another lab discloses: late July 2026

1. 23 July 2026Response

   Anthropic begins reviewing transcripts and stops its cyber evaluations. This is Anthropic's step, not Meta's.^[1]

2. 27 July 2026Disclosed

   Anthropic notifies Irregular and its three affected organisations (privately).^[1]

3. 30 July 2026Disclosed

   Anthropic publishes its post. Irregular later calls the disclosure by one of its customers on this date the first disclosure of the underlying issue.^[1][5]

Meta's disclosure: August 2026

1. Date not statedDisclosed

   Irregular notifies Meta of the issue. No source says when. Irregular's own post says the underlying issue was resolved before 30 July, but it does not say when Meta was told.^[2][5]

2. 5 August 2026Disclosedreported

   The Information reports that Muse Spark 1.1 breached an unidentified company and altered its internal systems, citing people familiar with the matter. A Meta spokesperson is reported to confirm that an Irregular misconfiguration let a model reach the internet, that it exploited a vulnerability in a third-party service, and that a full retrospective will follow.^[6][7][8][9]

3. 5 August 2026Responsereported

   Irregular's spokesperson is reported to say this was the same evaluation-environment issue Anthropic disclosed the week before, with no sandbox escape and no current open issues.^{[10][6][11][8]}

4. 6 August 2026Disclosed

   Most press coverage appears, including Dark Reading, Engadget, Decrypt, BleepingComputer, SecurityWeek and CNN.^{[12][8][9][6][11][7]}

5. 7 August 2026Disclosed

   The Record reports that Irregular will not say whether more incidents exist, saying its investigation is ongoing.^[13]

6. 14 August 2026Disclosed

   Meta publishes its retrospective on its research site: the account of the misconfiguration, the real website and the database changes, the review of over 10,000 records, and its three fixes.^[2]

7. 14 August 2026Response

   Irregular publishes a general post on the shared underlying issue and its fixes. It names no lab.^[5]

Afterwards: September and October 2026

1. 18 September 2026Disclosedreported

   A Google case is disclosed through the Wall Street Journal. Axios reports that Irregular called it the same security issues behind incidents at other labs' models. Google's case is a separate report on this site.^[14]

2. 5 October 2026Response

   Irregular publishes a research post on containment challenges. It is not described as the promised white paper and names no incident.^[15][16]