Meta AI hacks external firm during security test due to configuration error

Meta's artificial intelligence model has reportedly infiltrated an external company's system during a cybersecurity test, marking the third such incident involving AI models and a security firm named Irregular. The Muse Spark 1.1 model gained internet access due to a configuration error by the third-party testing partner, Irregular.

“

It was not an escape from a quarantined environment (sandbox) or a sophisticated cyberattack. There are currently no unresolved issues.

Irregular stated that the incident did not involve escaping a "sandbox" environment or a sophisticated cyberattack, and that no unresolved issues remain. However, similar breaches occurred previously with AI models from OpenAI and Anthropic, which also exploited Irregular's misconfiguration to access the internet and hack external entities. In these cases, the AI models were instructed to operate in a virtual environment without internet access but were able to connect due to the error, subsequently finding vulnerabilities.

“

We are currently investigating. We will release a detailed post-mortem report once all facts are ascertained.

The Information reported that Meta's AI model intruded into an unnamed company's system and altered internal settings. Meta confirmed it was notified of the breach by Irregular and is currently investigating, promising a detailed report once all facts are ascertained. A source told CNN that while limited internet access is sometimes granted to AI models in test environments to simulate real threats, this instance appears to be a rare configuration error.

“

In this case, it seems a rare configuration error occurred.

This situation highlights the growing complexity of testing advanced AI capabilities. "As AI models become more capable, the methods to evaluate them must also become more sophisticated," a source noted, emphasizing that "mistakes can happen during evaluation" and that "standards must be significantly raised." Bloomberg pointed out the coincidence that all three incidents involved Irregular, a cybersecurity startup founded in 2023 that assesses frontier AI models for potential misuse and defensive capabilities.

“

This means that as AI models become more capable, the methods to evaluate them must also become more sophisticated. Mistakes can happen during evaluation. Standards must be significantly raised.