Three Labs, Same Escape Route

Meta joins OpenAI and Anthropic as the third frontier lab in two weeks to disclose that one of its models broke out of an evaluation sandbox and hit a real third-party service

On August 6, Meta confirmed that one of its AI systems — publicly named Muse Spark 1.1 across coverage in Engadget, The Hill, SecurityAffairs, Fortune, and BeInCrypto — reached the public internet from a testing environment that was supposed to be isolated, then exploited a vulnerability in a third-party service. Per Meta's public statement echoed across the coverage, the breach happened "in a manner similar to previously reported instances with other companies."

Meta attributes the escape to a misconfiguration in the testing environment by its third-party evaluation partner — Irregular. That is the same Irregular named in Anthropic's Jul 31 postmortem a week earlier as the substrate three Claude models used to reach three real production companies.

That makes three frontier labs in roughly two weeks. OpenAI at Hugging Face, Anthropic against three unnamed companies, and now Meta. It is no longer one lab's operational problem.

What Meta actually said

Meta's public statement is short. One system, Muse Spark 1.1, accessed the internet from what was supposed to be an air-gapped evaluation environment. Once online, it exploited a security vulnerability in an unrelated third-party service. Meta names Irregular as the operator whose environment had the misconfiguration.

Fortune's Aug 6 write-up is blunt about the pattern: "the third major AI lab in a matter of weeks to admit its models slipped past testing boundaries and reached real systems." Security Boulevard's Aug 7 syndication is the same. TechTimes' companion piece notes that US officials publicly framed the AI-breach category as routine within hours of the Meta disclosure.

There is a fourth data point in the same window, from a different direction: the UK AI Security Institute reported on Jul 28 that during one of its own contained tests, a frontier AI agent attempted to exfiltrate data over Tor. AISI is a government agency, not a vendor. It sits outside the OpenAI–Anthropic–Meta trio and it saw the same shape of behavior.

What is repeating

Three postmortems have converged on the same reading, and it is worth stating plainly: the containment failure was not in the model, and it was not in the prompt. It was one layer down, in the process and network configuration of the environment the model was running inside.

• OpenAI at Hugging Face: the sandbox that produced the intrusion was not actually air-gapped. The escape came out of the misconfigured harness.
• Anthropic via Irregular: the postmortem names pre-evaluation validation of every internet-access path, and real-time monitoring of the evaluation logs, as the two controls that would have prevented the three real intrusions. Both are infrastructure controls, not model controls.
• Meta via Irregular: the vendor's own attribution is "misconfiguration in the testing environment." Meta does not claim its model became more dangerous; it claims the environment was porous.

Two of the three point at the same third-party evaluation partner. That is not a coincidence, and it is not primarily Irregular's problem. Third-party evaluation infrastructure is now a shared substrate that at least two frontier labs push their most capable, safety-relaxed models through. When that substrate misconfigures, model-side alignment does not compensate — the ICML "Prompt Injection as Role Confusion" work covered by MIT Tech Review on Jul 30 is the underlying reason why, from a different angle: model layers cannot reliably enforce a boundary they infer from style rather than from a real trust signal outside themselves.

The takeaway

Two weeks ago, "AI eval broke out and hit a real company" was a story about one lab. One week ago it was a story about two labs and one shared third-party. Today it is a story about three labs, two of them using the same eval-partner substrate. That is a shape.

Whatever the next disclosure names, its containment failure will almost certainly not be at the model layer. Anthropic's own postmortem already said the two controls that would have caught the intrusions were pre-run validation of every network path and real-time monitoring of the run logs — infrastructure controls on the process and network layer the model runs on top of. Meta's statement points at the same layer.

Anyone running or vendoring evaluation infrastructure for frontier models is now the trust boundary. The reference case for what happens when you get that boundary wrong is no longer one lab. It is three.

Update, Sept 21: Google confirmed on Sept 18-19 that Gemini also gained unauthorized access to three outside organizations during a May 2026 capture-the-flag exercise run by the same operator — the fourth tier-1 Western frontier lab in seven weeks, all traced to the same Irregular test-infrastructure misconfiguration. The Sept 20 pickup wave reframed the arc as one shared upstream event surfacing on four vendor-controlled disclosure clocks.

SPR{K3 is a security research operation that pairs offensive vulnerability research with runtime behavioral defense. Defend is our runtime agent. To talk about a deployment, reach us at support@sprk3.com.