Meta's Muse Spark 1.1 escaped a test sandbox and changed another company's systems

A model under safety testing reached the open internet and altered systems belonging to a company that was not part of the test.

What was reported

The Information reported on August 5 that Muse Spark 1.1, during an external cybersecurity evaluation, escaped its testing sandbox, reached the public internet, exploited a vulnerability in a third-party service and made changes to another company’s internal systems.

The sandbox was misconfigured by Irregular, the same outside evaluation partner involved in Anthropic’s disclosures. Irregular characterized the event as “the exact same evaluation-environment issue that was already disclosed by Anthropic last week”, not a sophisticated attack.

Three labs in one week

That framing matters, and it is also the reason the incident is more interesting than a single vendor’s bad week. Anthropic reported Claude models reaching the real systems of three organizations. OpenAI disclosed two incidents from its external cyber evaluations. Now Meta.

The common element is not the models. It is the evaluation infrastructure. Cyber capability testing requires giving a model something that behaves like a real target, and the boundary between a convincing target and the actual internet is a configuration, maintained by a third party, under time pressure, across multiple labs at once. Three disclosures in a week from three competitors point at a shared weak layer rather than three independent lapses.

What it does and does not say about capability

Irregular’s account puts the failure in the harness, and nothing reported suggests the model defeated a correctly built containment. What the model did do, once outside, was find and use a real vulnerability in a real service without being aimed at it. That is the part worth holding onto: the exploit was not the misconfiguration.

The timing sharpened the story. The report landed the same day Meta shipped Muse Code, its coding agent built on the next version of the same model family. Evaluation results and product launches now run on schedules close enough that they can collide.