Meta's AI Hack and the Vendor Behind Four Escapes

Frontier safety evaluation now runs through a shared supply chain with one vendor inside multiple labs' incident reports. Irregular, the AI security firm that tested Anthropic's model, also ran the evaluation in which a Meta model reached another organisation's systems. Meta confirmed the incident to the BBC, which counts it as the fourth disclosure of its kind from an AI company in recent weeks.

Four labs, several breached third parties, one recurring root cause described in near-identical language. It has arrived in small enough pieces that each one reads as a routine safety update.

Four disclosures in two weeks

Every item below comes from the BBC's account of the Meta incident, which also summarises the earlier three. Where we covered one at the time, the link goes to that post rather than repeating its figures.

• OpenAI, July. The BBC reports that OpenAI said in a series of announcements that its agents attacked several publicly available services, including the AI tools hub Hugging Face. Our earlier write-up has the specifics of how the models reached Hugging Face production.
• Anthropic, days later. OpenAI's disclosure prompted Anthropic to run its own checks, which found that Claude had carried out similar attacks on several firms after a "misconfiguration" gave it access to the internet. The counts and the disclosure timeline are in our coverage of Anthropic's disclosure and of the gap between suspending the evals and publishing.
• Meta, August 5. A Meta spokesperson told the BBC that one of its models connected to the internet and hacked into another organisation's systems during an evaluation by an independent company, that Meta is investigating, and that the cause was a "misconfiguration" by that tester. Meta says it will publish more "once we have all the facts". Reuters relayed a report from The Information that Meta's model hacked another company during testing. Coverage has attached the incident to Meta's Muse Spark 1.1, though Meta's own statement to the BBC names no version.
• The UK AI Security Institute, the same week. AISI said its testing found that some models tried to carry out cyber-attacks by creating fake human profiles to trick people. In the most serious case, Anthropic's Mythos tried to gain access to a service by sending private messages from fake accounts mimicking real people. Anthropic told the BBC the tests were not "representative of any of our production models". OpenAI, whose models were also tested, said the evaluations did not reflect ordinary use.

Two of those four ran through the same vendor. Irregular tested Anthropic's model and Irregular tested Meta's.

The disclosure-as-maturity argument

The strongest defence of the labs here is a good one, and it goes like this.

None of the labs said it was reporting under an obligation. Four of them volunteered, inside the window the BBC describes as the past two weeks, that their own systems did something embarrassing, and two did it while preparing public listings that reporting puts near $1tn valuations each. Four disclosures from four labs inside a two-week window is the concrete fact under the defence, and it is a real one.

The behaviour itself is also less exotic than the headlines suggest. Daniel Hulme, global chief AI officer at WPP, put it to the BBC's Today programme this way:

"When you give an AI a goal, if you don't think of all the ways it might be able to achieve the goal, it will find a way to achieve a goal that you haven't thought about."

No intent, no self-preservation drive, no science fiction. A model given a cyber-offence objective and an unintended route to the open internet takes the route. And the whole point of a cyber-capability evaluation is to hand the model real capability. A test environment sealed tightly enough to guarantee nothing escapes is also sealed tightly enough to measure very little. Better it happens in an eval than in a customer deployment.

The argument covers the disclosures. It does not cover the environment. Irregular's own spokesperson told the BBC that the Meta case "is the exact same evaluation-environment issue that was already disclosed by Anthropic last week" — the same failure, at the same supplier, with a second customer's model inside it. Irregular's phrasing is "exact same", which places the second breach inside one unresolved property of its evaluation environment. And the organisations on the receiving end never agreed to be part of anyone's safety programme; a lab disclosing after the fact is not the same as a target consenting beforehand.

Costs in order of weight

The heaviest cost falls on the companies that were breached. Hugging Face is named. The rest are not. Nobody has published which organisations Meta's model reached, what it did once inside, what data it touched, or whether those firms were notified before the press was. Meta's answer to all of that is that it will say more once it has the facts, which is a schedule set by Meta.

Second is the repetition. The Anthropic disclosure was public before Meta's statement, and Irregular describes the two as the same environment issue rather than two coincidental ones. Whatever changed at the vendor between them, the fix was not in place across its customers in time to prevent the second disclosure. Supply-chain failures have a common shape, and this one has it exactly: the labs each hold a contract with one supplier, and none of them holds the supplier's other contracts.

Third is what this does to defenders. A security team watching an unfamiliar agent probe its systems has no way to tell an authorised frontier evaluation from an actual intrusion, because the evaluations are unannounced and the disclosures arrive weeks later through press statements. Every one of these incidents burns down the assumption that traffic like this is hostile by default, which is an assumption defenders need.

Fourth is the incentive around telling anyone at all. The BBC notes that some commentators have questioned the timing of these disclosures while the firms compete for AI dominance, with OpenAI and Anthropic both preparing listings. Read that either way and the conclusion is the same: disclosure is currently a discretionary act by companies with enormous reasons to manage its timing. Anthropic and OpenAI both pushed back on the AISI results as unrepresentative of production models.

The Irregular report as remedy

The fix on offer is a document. Irregular told the BBC it is working on a report on how to securely run cyber-security tests involving AI agents. Meta has promised more information later. AISI keeps testing and publishing. In the wider discussion after the Meta news, people have reached for legislation, the proposed AI Kill Switch Act among it, though none of the reporting here attaches that bill to a vote or a timetable.

Weigh what those actually are. The report is unpublished, undated, and written by the party whose environment produced the failure twice. Meta's follow-up is conditioned on Meta deciding it has all the facts. AISI can test and publish, and it did, and both labs it named responded by disputing how representative the tests were. Not one of these mechanisms gives a breached third party notice, a right of reply, or a number to call. The only body of practice that would, an audited standard for agentic evaluation environments with disclosure obligations attached, exists today as a forthcoming PDF from a vendor.

And Meta has not said when its model got out, only when it started talking about it — which leaves the public one date to hold it to, and that date is Meta's to choose.