Another day, another tech giant – it’s Meta this time – saying its model had broken containment and hacked into another organization’s systems. The incident looks terribly similar to previous breaches reported by OpenAI and Anthropic – but is it?

This and similar breaches previously reported by OpenAI and Anthropic occurred during testing, of course, causing no real-world harm.

That’s why some critics say they were all just publicity stunts, designed to show they’re dominant in the industry of AI development. This especially applies to Meta, a company that has invested billions in AI but struggled to keep up with rival labs.

On the other hand, cybersecurity experts are telling Cybernews that even if these failures are more accidental than intentional, they’re by now “exhausting” and “unacceptable.”

What exactly happened this time?

As first reported by The Information, Meta said on Wednesday that one of its AI models hacked another company ​during cybersecurity testing, once again fanning concerns about how developers can contain increasingly capable AI systems.

Apparently, a misconfiguration by Irregular, an independent company that conducts cybersecurity evaluations for Meta, inadvertently gave one of its models internet ​access during testing.

The model involved was Meta’s Muse Spark ​1.1, which the company has touted as its most capable model for real-world coding and agentic tasks.

Tech giants are wrestling for dominance, and OpenAI and Anthropic are preparing stock market listings, expected to value each firm at around $1 trillion.

Muse Spark 1.1 “exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies,” Meta said in a statement.

That’s not exactly true, though. The incidents at Meta and Anthropic stemmed from configuration errors that inadvertently gave Anthropic's models access to the open internet.

Another similar setup error recently also allowed Kimi K3, a China-based AI model, to escape a cybersecurity testing sandbox.

Only in OpenAI’s case, an AI agent independently exploited a previously unknown vulnerability to reach the internet during cybersecurity testing. That’s, of course, only what OpenAI is claiming.

Quite a few experts and observers believe these reports are mostly publicity stunts aimed at showing how powerful their technology is. Tech giants are wrestling for dominance, and OpenAI and Anthropic are preparing stock market listings, expected to value each firm at around $1 trillion.

“It appears frontier models are getting FOMO now, and each needs to have their own lab breakout story,” Damian Skeeles, senior solution engineer manager at Filigran, told Cybernews.

“Open Pandora’s box and throw away the key”

But others are taking the incidents more seriously, as it increasingly appears difficult to run cybersecurity tests securely involving AI agents. The industry is now hearing calls for tougher safeguards.

Just so it happens that earlier this week, the UK government-backed AI Security Institute (AISI) revealed that OpenAI and Anthropic models took “unsanctioned action on the live internet” and even created fake identities on GitHub to make a human user approve a malware-ridden software update.

“Some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organizations,” AISI said in a blog post.

The report underscores the lax state of safeguards in the testing of agents, which AI companies are simultaneously marketing as the future of business.

“AI frontier labs have been granting and selling access to these models in private on the presumption that they are too dangerous to use by regular users, and that only the select few who have the technical expertise and solid legal and moral limitations can run them,” wrote Catalin Campanu, a news editor at Risky.biz.

“But it’s now clear that even an AI security vendor or a government AI evaluator can’t keep these models in check.”

A pattern is starting to emerge, and if we’re not going to run these Pandora’s box experiments in safe, realistic environments, we might as well just open the box up and throw away the key,

Jason Rivera

Jason Rivera, Field CISO at SimSpace and a former Army Intel Officer, agrees that our containment infrastructure cannot really keep up with the cyber capabilities of frontier AI models.

“The environment that’s supposed to be sandboxed isn’t actually sealed off, nor is it sufficiently effective and realistic enough to contain the model, and then the model ends up reaching a real organization’s live systems instead of a controlled target,” said Rivera.

“A pattern is starting to emerge, and if we’re not going to run these Pandora’s box experiments in safe, realistic environments, we might as well just open the box up and throw away the key.”