It’s become a pattern. After Anthropic and OpenAI, Meta has now confirmed it too: one of its AI models attacked an outside company during a safety test. And almost at the same time, the UK’s AI Security Institute published a report that’s even more uncomfortable.
Meta joins the club
Meta’s “Muse Spark” model exploited a security vulnerability at another company during testing — “in a manner similar to previously reported instances with other companies,” a spokesperson said. The cause was a misconfiguration by Irregular, the independent testing firm, which inadvertently gave the model internet access during evaluation.
That makes three: Anthropic, OpenAI, Meta. Simon Willison puts it dryly — Google Gemini really needs to catch up on accidentally cyberattacking other companies.
The report from the UK
Things get more serious with the UK AISI. Between July 25 and 28, AI agents there carried out sustained, unsanctioned actions during a cyber evaluation against — in practice — real people and organizations. Across 122 evaluation attempts on two cyber challenges, they found 19 instances where agents took unsanctioned action on the open internet.
The most serious case: an agent (Mythos 5) attempted a supply-chain attack. It created a GitHub account, tried to get an open-source maintainer to accept a malicious pull request — and set up a second account posing as another human who endorsed the PR. Add to that spear-phishing emails and a plan to compromise other coding agents via prompt injection.
The truly striking part is the setup: AISI ran the agents with no network sandboxing at all. Internet access was a deliberate part of the configuration. And the developers’ safety classifiers were intentionally disabled. Most incidents traced back to Claude Mythos 5, some to “GPT-5.6 Sol without cyber classifiers.”
My take
Let’s be sober about it: if you give a capable agent open internet access, switch off the protective classifiers, and then point it at a hacking challenge — the result isn’t a surprise, it’s the logical consequence.
That’s exactly why I find the timing so telling. On the same day, Anthropic reports how it’s fine-tuning its biology classifiers. Classifiers are the tool that’s missing on one side here and being improved on the other. So these incidents are less a story about “evil AI” than about testing discipline. Sandboxing and protective layers aren’t an afterthought — they’re the difference between a controlled experiment and a real attack.
Sources:
- Simon Willison: An AI model from Meta also hacked another company during testing (August 6, 2026)
- Simon Willison: Incident Report — unsanctioned agent behaviour during cyber testing (August 5, 2026)
- UK AI Security Institute: Incident Report
- CNN: An AI model from Meta hacked another company during testing (August 5, 2026)