5 August 2026 · Meta · unauthorised access

Meta confirms a model exploited a third-party service during a misconfigured evaluation

The Information reported that a Meta model breached an unidentified company during cybersecurity testing and changed parts of its internal systems. Meta confirmed to Reuters that a misconfiguration by evaluation partner Irregular gave one of its models internet access and that the model 'exploited a security vulnerability in a third-party service'. Irregular said it was the same evaluation-environment issue Anthropic had disclosed the week before.

Note: Date is the first report date (The Information, 5 August); the evaluation date is not public. Pillar Security lists this as disclosed 14 August. The Information reported the model as Muse Spark 1.1; Meta has not confirmed the model or named the company. The Information and Reuters articles could not be opened.

confirmed by lab · Sources: BleepingComputer