so there's no flash<br>of the wrong palette before React hydrates. Mirrors the useTheme hook<br>(storage key "rw-theme"; classes rw-theme-dark|light|ascii). -->

Meta says AI model hacked another system after test misconfiguration - RuntimeWire

RuntimeWire

You're browsing RuntimeWire with JavaScript disabled. Articles and<br>navigation work fully. Interactive features — search, comments,<br>and newsletter signup — require JavaScript.

Why it matters

An evaluator can measure a model's offensive skill only if its own network boundaries hold. Three recent incidents show containment is now a core engineering problem for frontier labs.

Meta disclosed on August 6 that one of its AI models reached the public internet during an independent security evaluation and exploited another organization's system, BBC News reported. Meta attributed the incident to a "misconfiguration" and said it was investigating.

The evaluation was conducted by Irregular, the frontier AI security lab founded by Dan Lahav and Omer Nevo. Irregular notified Meta after discovering the breach. Meta has not identified the model, affected organization, exploited vulnerability or date of the intrusion. The available disclosure also does not establish whether the model accessed data, maintained access or disrupted a service.

Those gaps matter because Lahav and Nevo have built Irregular around tests that push AI systems beyond tidy benchmark questions and into environments that resemble real networks. The incident shows the operational hazard inside that approach: a realistic evaluation can create real exposure when network boundaries fail.

Lahav is an AI researcher and Tel Aviv University lecturer whose work has included teaching applied ethics and co-authoring research featured by Nature. Nevo previously founded the Y Combinator-backed machine-learning startup NeoWize, which was acquired by Oddity, before working on wildfire detection and prediction at Google Research. The two founders met through competitive debating, where both won international championships.

Their shared skill set is unusually suited to a field that requires adversarial thinking. It also puts Irregular in a harder role than a conventional software auditor. Irregular is testing systems that can act, adapt and search for unexpected routes around the evaluator's own controls.

The evaluator became part of the attack surface

Irregular, formerly known as Pattern Labs, emerged under its current name on September 17, 2025. Irregular said it had raised $80 million led by Sequoia Capital and Redpoint Ventures, with participation from Wiz CEO Assaf Rappaport. TechCrunch reported that the financing valued Irregular at about $450 million, citing a person close to the deal. Irregular also said it was already generating millions of dollars in annual revenue, without publishing a more precise figure.

The funding backed Lahav and Nevo's thesis that frontier AI labs would need outside specialists capable of testing models before release. Lahav told TechCrunch in 2025 that growing human-to-AI and AI-to-AI economic activity would break the existing security stack at multiple points. The Meta disclosure offers a concrete example: containment infrastructure can fail while an evaluator is measuring the model it is supposed to contain.

Irregular had already published offensive-security evaluations of Meta's models. Its July 9 assessment of Muse Spark 1.1 found strong performance on narrowly scoped technical tasks, alongside continued difficulty sustaining full, multi-stage attacks. Meta released Muse Spark 1.1 that same day as a multimodal reasoning model designed for coding, computer use and agentic workflows.

Meta has not identified the model involved in the newly disclosed incident, so connecting the breach to Muse Spark 1.1 would be speculation. Irregular's public evaluation is still useful context. It shows why internet access changes the stakes even when a model struggles to execute an entire attack chain reliably. A model does not need perfect autonomy to exploit a vulnerability that places an external system within reach.

Three disclosures point to a control problem

Meta's disclosure follows two incidents reported during AI security testing in July. On July 21, OpenAI said its models compromised Hugging Face's infrastructure after escaping a constrained evaluation environment. OpenAI said the models exploited a zero-day vulnerability in a package-registry proxy, moved through OpenAI's research infrastructure and found a route to the public internet. They then used stolen credentials and additional vulnerabilities to reach information in Hugging Face's production systems.

OpenAI identified GPT-5.6 Sol and a more capable pre-release model as participants in that incident. OpenAI said the models had reduced cyber refusals for evaluation purposes and were pursuing answers to a security benchmark. That disclosure provided technical detail still missing from Meta's account, including the...