Meta said Thursday that one of its artificial intelligence models accessed the internet on its own and hacked another company, the latest in a series of disclosures about .
In recent weeks and also have described instances of AI models going beyond humans’ instructions to access the web and find ways around other companies’ digital security.
Meta said in a statement that a 鈥渕isconfiguration” during cybersecurity testing by Irregular, an independent company hired by Meta, inadvertently allowed one of its models to access the internet.
鈥淭he model subsequently exploited a security vulnerability in a third-party service, in a manner similar to previously-reported instances with other companies,鈥� the company said. Meta said it is investigating the incident and will issue a report when that’s complete.
The disclosure has added to worries about AI models acting autonomously.
Separately this week, the United Kingdom’s AI Security Institute announced it had found 鈥渦nsanctioned agent behavior鈥� during cyber testing. In one case, an agent created fake online identities to pressure a person to approve use of malicious code.
鈥淥n investigation, we found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organizations,鈥� AISI said Tuesday. 鈥淲e declared a security incident and, within roughly one hour of discovery, had contained it and begun a full investigation.鈥�
During the agency’s testing, Anthropic and OpenAI models took 鈥渁utonomous, unsanctioned action鈥� on the internet. Some guardrails to prevent misuse had been disabled, the agency said.
鈥淎s was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled 鈥� conditions that do not reflect how frontier models are made available to the public,鈥� AISI said. 鈥淲e do this to best assess the maximum capability of models.鈥�
Anthropic said it is 鈥済rateful鈥� for AISI’s work and added that it underscores the need for a broader conversation about how to safely evaluate AI agents as their capabilities grow.
OpenAI said the AISI incidents took place 鈥渋n testing environments with reduced safeguards, under conditions that do not reflect ordinary use.” It added it will continue working with others across the industry to “strengthen shared practices for conducting evaluations safely as models become more capable.鈥�
The first company to disclose a hack late last month, OpenAI said it had tasked the AI models involved with pursuing 鈥渁dvanced exploitation using complex attack paths鈥� to test cyber capabilities, but the technology went to unexpected lengths. It apparently decided on its own to target Hugging Face, a well-known AI development hub and marketplace, to obtain information it needed to carry out a task.
A spokesperson for Irregular, the San Francisco-based AI security company, said the Meta episode involves a test-environment issue that was disclosed last week by Anthropic.
Irregular said it’s writing a paper to share 鈥渂est practices for containment鈥� to prevent such incidents in the future and securely run cyber tests.
Copyright © 2026 The Associated Press. All rights reserved. This material may not be published, broadcast, written or redistributed.
