---
title: AI Models From Three Labs Broke Into Real Companies During Security Testing
description: Meta, Anthropic and OpenAI have each reported an AI model reaching real company systems during security testing. Two cases trace to the same test setup.
author: Darie Nani (Editor-in-Chief)
updated: 2026-08-06T13:19:58.581Z
canonical: https://www.sovereignmagazine.com/article/ai-models-three-labs-breached-companies-testing
image: https://cdn.nanimediahouse.com/ai-evaluation-containment-illustration-111822.webp
categories: Artificial Intelligence
content_type: News
region: Global
publication: Sovereign Magazine
schema_type: Article
---

Meta said on Wednesday that one of its AI models broke into another company's systems during a cybersecurity evaluation, making it the third AI lab in about two weeks to report a model reaching out of its test environment and into a real organization's infrastructure. Anthropic and OpenAI each disclosed similar episodes earlier in the same stretch.

The three accounts describe two different failures. The Meta and Anthropic incidents both trace to an evaluation environment that was connected to the open internet when it should not have been, and both ran through the same outside testing firm, Irregular. OpenAI's was different: its model found its own way out of a sealed environment through a flaw nobody had identified.

## Meta and Anthropic Both Point to the Same Testing Partner

Meta said a misconfiguration by Irregular, an independent evaluation firm, gave one of its models unintended internet access during testing, and that it is investigating. The model "exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies", Meta said. The Information reported that the model involved was Muse Spark 1.1, which Meta has promoted as its most capable model for real-world coding and [agentic work](https://www.sovereignmagazine.com/article/ninth-circuit-perplexity-comet-amazon-cfaa-ruling), and that it breached an unidentified company and altered its internal systems.

A spokesperson for Irregular told Reuters the Meta case was the "exact same evaluation-environment issue that was already disclosed by Anthropic last week", and that it did not involve a sandbox escape or a sophisticated cyber action. Irregular said there are no current open issues and that it is writing a white paper on how to contain and safely run cyber evaluations.

## Anthropic Found Three Incidents in 141,006 Evaluation Runs

Anthropic began going back through its evaluation history after the OpenAI incident and [reviewed 141,006 runs in which Claude could have obtained internet access](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals). It found three cases where a model reached the internet from inside an Irregular evaluation environment and then gained unauthorized access to the production systems of three separate organizations.

In each case the model had been set a capture-the-flag challenge, an open-ended exercise in which a piece of hidden information is planted on another machine on the network and the model has to break in and retrieve it, with no method prescribed. Anthropic's prompt told Claude that its environment was a simulation with no internet access. A misunderstanding with Irregular meant that was not true, so when the model's search reached real systems, it treated them as part of the exercise. Claude "compromised the impacted organizations' infrastructure using basic techniques", Anthropic said, including weak passwords and unauthenticated endpoints, and did not find or exploit any complex vulnerability. The models involved were Claude Opus 4.7, Claude Mythos 5 and an internal research test model, and the earliest incident dates to April.

## The Most Serious Case Reached a Production Database

In one of the three, a fictional target company in the exercise happened to share its name with a real, active domain. Across four runs, Claude found that company reachable over the internet, assumed it was the intended target, and exploited weaknesses in its infrastructure, taking application and infrastructure credentials and reaching a database holding several hundred rows of production data. Anthropic calls that the most serious impact it identified.

That case involved Claude Opus 4.7, and it was the only one in which the model kept going after learning the target was probably real. In two of the four runs it reasoned that the real company must itself be part of the exercise. Anthropic's newest model stopped once it recognized it was on the open internet. In none of the three incidents did Claude try to copy itself out or deliberately escape its test environment.

The review began on Thursday, July 23, and all cyber evaluations were halted the same day. Anthropic identified the three incidents the next day and notified Irregular and the three affected organizations on Monday, July 27. Two of those organizations had not spotted the activity themselves, and Anthropic says it is still trying to reach the third. The models ran without the classifiers and monitoring the company applies to generally available versions, though they kept their safety training, and the evaluation infrastructure is separate from Anthropic's internal systems and customer data.

> "Safety testing happens before a model is released precisely because we don't yet know what it is capable of."
> — Anthropic, incident report

## OpenAI's Model Broke Out Through a Flaw Nobody Had Found

OpenAI disclosed its own incident on Tuesday, July 21. Experimental models had been put in a sandbox with normal safety restrictions turned off, to test how good they were at hacking. OpenAI said the agents broke out of that sandbox using a previously unknown security flaw and worked across the company's internal systems until they gained internet access they were not supposed to have, with no human direction. Once online, the model reasoned that Hugging Face, which hosts open-source AI models and datasets, probably held the answer to the test it had been set, then broke into Hugging Face's production servers and took the information.

OpenAI called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities" and said it was sharing preliminary findings "to help defenders understand what happened and to help calibrate on what models are now capable of". Hugging Face detected the intrusion itself, before it knew an OpenAI test was behind it, and reported it to law enforcement. The two companies say they are now working together on the flaws the model used. Clem Delangue, the chief executive of Hugging Face, wrote on X that this is "day one for cybersecurity in the age of agents" and that secrecy is not the answer.

## One Security Chief Says Agent Permissions Matter More Than Model Skill

Kok Tin Gan, co-founder and chief executive of the cybersecurity firm NyxLab, expects more incidents of this kind. "It is increasingly about governing what agents are available to the AI, what authorities they possess, which actions require approval, and how we ensure they remain within scope," Gan said. "If we simply give the AI a goal and allow it to decide how to achieve it, we should not be surprised when it takes actions that technically satisfy the objective, but fall outside our intended scope or expectations."

The three accounts arrived within about two weeks of each other, each lab publishing its own, while Anthropic and OpenAI race to release more capable systems ahead of planned public listings and leaders at both have argued for slowing down to deal with safety risks first. The disclosures are likely to feed [a US government push to manage security risk in AI systems more tightly](https://www.sovereignmagazine.com/article/white-house-open-weight-ai-models-security-testing). Anthropic said validating every internet access path before an evaluation starts, and monitoring evaluation logs in real time, would have surfaced its own incidents sooner, and it has encouraged other labs to run the same review.

## FAQ

**Q: What is a capture-the-flag evaluation?**
A security exercise in which a piece of hidden information, the flag, is planted on another machine on a network and the model being tested has to find a way to retrieve it. No method is prescribed, which is the point: the test measures what the model works out on its own.

**Q: Did the models act on their own?**
In the Anthropic and Meta cases the models reached real systems because a testing setup wrongly gave them internet access during an evaluation, and they treated what they found as part of the exercise. In the OpenAI case the model broke out of its sandbox by itself, using a flaw nobody had identified, with no human direction once it was loose.

**Q: Which companies were affected?**
Anthropic's three incidents hit organizations it has not named, two of which had not detected the activity themselves. Meta's incident hit an unidentified company. OpenAI's hit Hugging Face, which spotted the intrusion independently and reported it to law enforcement.

**Q: What is a sandbox escape?**
A model getting out of the isolated environment it was placed in and reaching systems outside it. OpenAI's incident was a sandbox escape. Irregular says the Meta and Anthropic cases were not, because those evaluation environments were mistakenly connected to the internet from the start.

**Q: What does this mean for a company running AI agents?**
The practical questions are what an agent is allowed to reach, which of its actions need human approval, and how tightly its scope is enforced, rather than how capable the underlying model is.