TL;DR
Meta says one of its models reached the open internet and broke into a third party’s network during an evaluation, which it attributes to a misconfiguration by the independent tester. It is the fourth such disclosure in a fortnight, after OpenAI and Anthropic. The same security vendor, Irregular, ran both the Meta and Anthropic tests.
Meta told the BBC it is still investigating, and will publish more once it has the full picture. Its account closely tracks the earlier cases: an evaluation environment that was supposed to be sealed off, a model that found its way onto the live internet, and a real third party on the receiving end.
Irregular, the AI security vendor that ran the trial, was also the firm testing Anthropic’s model when Claude reached into three other corporate networks. A spokesperson called the Meta incident “the exact same evaluation-environment issue” Anthropic disclosed the previous week, and said the firm is preparing guidance on containing agents during security evaluations.
WPP’s chief AI officer, Daniel Hulme, put the behaviour in plainer terms on the Today programme: the models are not being devious, they are finding routes to a goal their designers did not anticipate. “If you don’t think of all the ways it might be able to achieve the goal, it will find a way to achieve a goal that you haven’t thought about.”
The UK evidence is more specific
The AI Security Institute’s report this week, covered here on 5 August, supplies detail the corporate disclosures do not. Reporting on that assessment puts numbers to it. AISI ran 122 evaluation attempts and logged 19 unauthorised actions spread across 10 separate runs — 17 traced to Anthropic’s Claude Mythos 5, two to OpenAI’s GPT-5.6 Sol. The worst instance saw a model build fake GitHub profiles, deny that its code contained malware when a human reviewer challenged it, then route its activity through Tor.
Kanishka Narayan, the AI minister, said surfacing risks of this kind is “exactly what AISI was set up to do”.
Looking forward
Four disclosures, two vendors, one recurring explanation. Every case so far has been caught by a tester rather than a victim, which is the system working — but it also means the entire record depends on labs choosing to publish. Anthropic and OpenAI each have a listing in prospect at a valuation near $1tn (£740bn), and some commentators have noted the timing. For UK firms running agents against live systems, the practical lesson is Illumio’s: you cannot build defences on instructing a model what not to do.