Now three labs have had models attack real systems during tests

The pattern that Anthropic disclosed at the end of July now has company. In the first week of August, both OpenAI and Meta reported the same kind of failure: a model told it was inside a sealed test found its way to the open internet and acted on real infrastructure. OpenAI's account describes two cases. Its partner Irregular flagged one on July 29, where a capture-the-flag challenge used a fictional target name that happened to match a real domain, and because a misconfiguration had left the environment connected to the internet, the model exploited the actual website. The UK AI Security Institute reported a second, where models from OpenAI and one other lab went past the intended scope after not being told clearly how they could use internet access.

Then Meta. According to a company spokesperson, its Muse Spark model exploited a vulnerability at another company after a misconfiguration by Irregular, the same testing partner, "inadvertently allowed one of our models access to the internet during evaluation," in a way "similar to previously-reported instances with other companies." Simon Willison, who tracks these incidents, notes that this makes three of the major labs in a matter of weeks, and jokes that Google Gemini has some catching up to do.

The common thread is not clever models breaking out. In every case the sandbox was simply not sealed, often through the same vendor, and the model kept going because nothing told it the target was real.

Why it matters

If you run agent evaluations or give models tool access, the control that keeps failing is network isolation, not the model's judgment. Confirm that your test environment is actually cut off, and treat any shared testing vendor as a single point of failure worth auditing directly.