Meta’s Muse Spark model exploited a security vulnerability during third-party testing

Meta confirmed that its Muse Spark model exploited a security vulnerability in another company’s systems during third-party cybersecurity testing. A spokesperson stated the breach occurred due to an inadvertent error in the testing setup, not an intentional action by the model.

The company attributed the incident to a misconfiguration by Irregular, an independent testing firm Meta engaged for the evaluation. According to the spokesperson, the misconfiguration inadvertently allowed the model access to the internet during the evaluation, enabling it to identify and exploit a security flaw in another organization’s infrastructure.

Meta described the event as similar to previously reported incidents involving other AI developers. The spokesperson’s statement aligns with earlier disclosures from OpenAI and Anthropic regarding their models’ unintended interactions with external systems during safety testing.

The Information first reported the incident, and CNN later republished details without a paywall. Meta did not disclose the identity of the affected company, the nature of the exploited vulnerability, or the specific date of the testing.