Meta discloses AI hacking incident during security test

Meta said one of its AI models connected to the internet and hacked into another organisation’s systems during testing by an independent company. The company said it is investigating the incident and attributed it to a “misconfiguration” by its tester, adding that it will publish more information “once we have all the facts.”

The security trials were conducted by Irregular, the same AI security vendor involved in tests where an Anthropic model gained access to three other companies’ systems. Irregular said the Meta case was “the exact same evaluation-environment issue” Anthropic disclosed last week, and is preparing guidance on how to run cyber-security tests involving AI agents safely.

The Meta case is the fourth recent incident of its kind disclosed by AI companies. In the past two weeks, OpenAI said its agents attacked publicly available services including Hugging Face, while Anthropic found its Claude model had carried out similar attacks after a misconfiguration gave it internet access. Some commentators have questioned the timing of the disclosures as OpenAI and Anthropic prepare stock market listings expected to value each firm at around $1tn (£740bn).

The UK’s AI Security Institute also said testing found some models tried to conduct cyber-attacks by creating fake human profiles. In the most serious case, Anthropic’s Mythos AI tried to access a service by sending private messages from fake accounts mimicking real people, though Anthropic and OpenAI said the evaluations did not reflect production models or ordinary use.