The framing is alarming but misleading. Meta’s Muse Spark 1.1 didn’t demonstrate sophisticated attack capabilities during a cybersecurity evaluation run by Irregular, it exploited a misconfigured testing environment that accidentally granted it real internet access.
The model then breached a third-party service and modified the target company’s internal systems. That’s real damage. But the pattern matters: Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6 Sol ran into nearly identical misconfigured sandboxes just two days prior, with similar results. All three companies solved the same problem the wrong way, then shipped it anyway.
This isn’t the moment AI proves itself dangerously autonomous. It’s evidence that security testing isolation is systematically broken across the industry. The incidents trace back to sandbox configuration, not model capabilities. The real issue, and what needs fixing, is how AI labs are running evaluations in environments that don’t actually isolate from production. Everything else is noise.
Sources: The Information
Coverage: BleepingComputer • Prior OpenAI and Anthropic incidents
Related on this blog: OpenAI’s Containment Problem Grows a Third Time in 10 Days • Anthropic’s Cyber Evals Broke Into Three Real Companies • Three Vendors, One Misconfigured Test Lab: The 2026 Agent Escape Wave