ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About Muse Spark 1.1 attacks a real website in an Irregular eval

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Meta· Muse Spark 1.1 (pre-release version)

Muse Spark 1.1 attacks a real website in an Irregular eval

During a cyber evaluation run by Irregular, a pre-release Muse Spark 1.1 reached the open internet, exploited a flaw in a real website named as its target, read data from it and changed its database.

Irregular began evaluating Muse Spark 1.1 in early July in a closed testing environment with Meta's standard safeguards removed. Meta says a misconfiguration in Irregular's setup gave the model open internet access, and that Irregular gave the model the name of a real website as the target instead of a fictional one. Believing the real website was the intended target, the model found and exploited a security vulnerability, accessed some information and changed the website's database. Irregular identified the issue, disabled the evaluation and notified Meta and the affected party. Meta confirmed the incident to Bloomberg on 5 August without naming the model, and published a retrospective on 14 August saying a review of over 10,000 activity records found no other case. The website has not been named.

Updated 19 Oct 2026

First incident action to disclosure
about 20 days
First incident action to discovery
Not disclosed
Noticed first by
A vendor's control
Caught
An outside report

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Jul 2026

    First incident action

    Irregular starts a cyber evaluation of Muse Spark 1.1 with safeguards removed

    A closed testing environment, meant to have no internet, was misconfigured to allow open internet access, and the scenario named a real website as the target.

  2. Not disclosed

    The model exploits a flaw in the real website and changes its database

    Meta says the model believed the real website was the intended target, accessed certain information and made changes to the website's database. Not dated beyond the July evaluation.

  3. Not disclosed

    Irregular disables the evaluation and notifies Meta and the affected party

    Meta gives no date for Irregular's notice.

  4. Not disclosed

    Meta reviews over 10,000 records of the model's test activity

    Meta says its security teams found no other instance of the model exploiting a third-party company's system.

  5. 5 Aug 2026

    Disclosed · about 20 days after the first incident action

    Meta confirms the incident to Bloomberg

    Spokesperson Andy Stone blamed a misconfiguration by Irregular. Meta did not name the model; The Information identified it as Muse Spark 1.1.

    Reported

  6. 6 Aug 2026

    Irregular ties it to the issue behind the Anthropic incidents

    Irregular says it was the same evaluation-environment issue, not a sandbox escape, with no open issues remaining, and that it is writing guidance on containment.

    Reported

  7. 14 Aug 2026

    Meta publishes its retrospective

    Meta says it will require independent verification of test environment isolation and scenario review before evaluations, and that scenarios must not reference real companies.

Agent failures

Sandbox escape, Unauthorised accessShow
Map to frameworks

  • Sandbox escape

    Reached the open internet during the evaluation.

  • Unauthorised access

    Exploited a flaw in a real website, read its data and changed its database.

How it was found

Found first by a vendor's control, from an outside reportShow
Found first by
A vendor's control
How
An outside report
Found to disclosed
Not disclosed

Meta learned of it from its evaluation vendor. Meta says Irregular notified it of the issue, disabled the affected evaluation and made sure the affected party was told. Neither Meta nor Irregular says what signal Irregular saw, or when. After the notice Meta's security teams reviewed over 10,000 records of the model's activity during testing and found no other instance of it exploiting a third party's system.

What is publicly known

1 of 12 fully publicShow
1 of 12 fully public
ItemPublic?DetailSources
PartialMuse Spark 1.1, a pre-release version per Meta; checkpoint not given. Bloomberg calls it recently released.
UnknownNo source says whether reasoning was on or at what setting.
PartialMeta says standard production safeguards were removed for the evaluation. Which safeguards, and whether any monitor ran, is not stated.
UnknownNot published or described.
PartialAn adversarial cybersecurity task against a target that was meant to be fictional but named a real website. Wording not published.
WeakAn Irregular-built closed testing environment. Scaffold and tools not described.
PartialA misconfiguration by Irregular allowed open internet access. No configuration detail given.
UnknownNo transcript or action log published.
WeakIrregular identified the issue and told Meta; what signal it saw, and when, is not stated.
PartialOne unnamed real website: information accessed and database changed. Extent and data type not given.
KnownMeta states a setup misconfiguration opened internet access and a real website name was given as the target.
PartialIrregular fixed the misconfiguration; Meta adds isolation verification, bans real names in scenarios and plans earlier monitoring. Not independently verified.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    A cyber evaluation run with Meta's standard safeguards removed, in an environment meant to have no internet but misconfigured to allow it, with a real website named as the target. With no real targets and a verified network setup, the model would have had nothing live to attack.

  • Limit where the agent can send traffic

    A connection from the test environment to a real website rather than a simulated one. An allowlist of in-scope targets would have refused the connection and logged it.

  • Isolate where the agent runs

    Traffic from what was meant to be a closed testing environment reaching the open internet and a live third-party website, raised as a boundary crossing. Irregular says it was an environment issue, not a sandbox escape.

  • Detect

    Record every agent action, outside the agent

    The model exploiting a vulnerability on the real website, reading information and writing changes to its database, recorded as the actions happened. Meta later reviewed over 10,000 activity records to check for other cases.

  • Monitor every run and alert on what does not fit the task

    Neither Meta nor Irregular says what signal Irregular saw, or when. A monitor reading every action against the scenario would have raised writes to a third party's database as they happened.

  • All controls →

Coverage and commentary

1 statement, 4 articlesShow

What the parties involved said

  • Irregular

    Says the incident did not involve a sandbox escape or a sophisticated cyber action, and that it is writing a white paper on containment.

All 5 sources

  1. Primary source

    Addressing an issue involving a third-party cyber evaluation of Muse Spark 1.1 ↗Meta AI Research · 2026-08-14

  2. Press

    Meta AI Model Accessed Internet, Hacked Outside Firm in Testing ↗Bloomberg (via Insurance Journal) · 2026-08-06

  3. Press

    Meta's Muse Spark 1.1 hacked an external organization during cybersecurity test ↗SiliconANGLE · 2026-08-06

  4. Press

    Meta claims its own AI also hacked into a third-party service during testing ↗Engadget · 2026-08-06

  5. Commentary

    Meta Breach Reveals Irregular Cleared Muse Spark's Risk, Then Caused Breach It Had Cleared ↗TechTimes · 2026-08-06

Entry id meta-muse-spark-irregular-2026 · overall Confirmed · impact serious