Meta's coding model Muse Spark 1.1 got into a real company's systems during a security test — and even modified the internal environment. Headlines declaring "AI hacked another company" spread like wildfire. Did Meta just invent a world-class hacking model overnight?
Look closer: the door was left open. Again. Third-party evaluator Irregular misconfigured the test environment, connecting what should have been an isolated network range to the public internet. The model simply followed an existing path out, then exploited a basic vulnerability in a third-party service to get into the system. Irregular itself acknowledged that this wasn't a sandbox escape, and the attack wasn't exactly sophisticated.
The same kind of mistake has burned OpenAI and Anthropic before. An OpenAI model mistook a real website for a fictional target; an Anthropic model got into three organizations using weak passwords and unauthenticated interfaces. The common thread isn't that the models successfully broke out of their constraints — it's that the testers left the public internet door open first.
Hailing Meta's result is especially awkward. The model didn't pick a lock. It saw an open door and walked through. That proves nothing about breaking isolation, and it certainly doesn't deserve a headline about "autonomously hacking a company."
The clickbait formula is pretty much set: an exposed public network counts as hacking a company; guessing a weak password counts as hacking a company; finding a zero-day counts as hacking a company. The actual capabilities are levels apart, but the headlines look identical. AI models haven't learned to jailbreak yet — but the media has sure learned to hype.
The Information: A Meta AI Model Hacked Another Company During Cybersecurity Testing