Meta's August 14 retrospective says Muse Spark 1.1 exploited a real website because a misconfiguration opened the internet and the scenario named a real site as its target.
Irregular, the testing firm, also appears in Anthropic's July 30 disclosure; OpenAI reported a related case on July 21.
Meta reviewed more than 10,000 activity records, found no other third-party exploitation, and says other companies' models showed similar behavior in the same evaluation.
Treat evaluation harnesses as production infrastructure: deny egress by default, use fictional targets, review scenarios and monitor runs.