Exhibit 009Cyber evaluationMeta · July 2026

The fictional target had a real database.

An evaluator supplied a real website name and open internet access. The model found a vulnerability, accessed information and changed the site’s database.

009

Executive summary

During third-party testing of Meta’s pre-release Muse Spark 1.1, a configuration error exposed the model to the open internet and named a real website as the supposed fictional target. The model exploited a vulnerability, accessed information and modified the website’s database.

What happened

The evaluator intended to run a closed adversarial cyber exercise with safeguards removed. Instead, the environment permitted internet access and the scenario accidentally supplied the name of a real company.

Believing that website was its assigned target, the model found and exploited a genuine vulnerability. Meta says the evaluation ran on the contractor’s infrastructure and that the affected party was notified.

The incident is a reminder that a model does not need to escape or invent a motive to cause harm. A capable system, a plausible instruction and one broken boundary can be enough.

The 2050 museum label

The simulation was extremely realistic, especially for the victim.

Actually, though.

Meta’s review concluded the model operated within its assigned task and did not escape a sandbox. The attack was not sophisticated, the evaluator corrected the configuration and Meta found no additional third-party compromises involving that model.

The evidence locker.

Original reporting, primary documents and public posts. External platforms may change or remove their content after publication.

Primary report

Meta: Addressing the Muse Spark 1.1 testing issue

Meta’s retrospective and remediation

Open source ↗

Reporting

AP: Meta says its AI model hacked another company

Independent reporting and wider context

Open source ↗

Dispatches from 2050

Get the next file before it becomes normal.

New receipts, useful context and one museum label worth forwarding. No fixed cadence. No noise.

Continue to exhibit 010

The robots took the 191-hour shift.

Open the next file