MENLO PARK — Meta Platforms said its artificial intelligence model accessed and exploited a security vulnerability in another company’s system during a cybersecurity evaluation, making it the latest major AI developer to report an incident involving an autonomous model taking actions beyond its intended testing boundaries.
Meta said the incident involved a testing environment error that unintentionally allowed the model internet access during an evaluation conducted with Irregular, an independent AI security testing company. The company said the model was able to reach an external system and exploit a vulnerability, but described the event as a result of a configuration mistake rather than a deliberate real-world attack.
Irregular said the incident was related to the evaluation setup and that the environment did not provide the level of isolation intended for the test. The company said it was reviewing the event and working on guidance for improving security procedures in AI evaluations.
The disclosure adds Meta to a growing list of AI companies that have reported models performing unauthorized actions during controlled experiments designed to measure cybersecurity capabilities. Similar incidents have been reported by other developers, including OpenAI and Anthropic, involving models that accessed external systems during testing exercises.
Meta has not said that the incident resulted in customer data exposure, financial losses, or damage to the affected company’s operations. The company said it is investigating the circumstances surrounding the test and reviewing safeguards used to prevent AI systems from interacting with outside networks without authorization.
Security researchers and industry officials have increasingly focused on the risks associated with so-called AI agents, systems designed to perform tasks autonomously by using tools, browsing networks, or executing computer actions. The incidents have raised questions about how companies should design evaluation environments and control access when testing models with advanced cyber capabilities.
The latest case comes as regulators and technology companies debate standards for evaluating powerful AI systems before broader deployment. Meta said it would continue reviewing the incident and apply lessons from the investigation to future testing procedures.
