Meta has confirmed that one of its models reached the open internet during a cybersecurity evaluation and broke into a third party's systems. The model was Muse Spark 1.1, Meta's most capable system for coding and agentic work, and the access was an accident: the testing firm running the evaluation, Irregular, misconfigured its sandbox and inadvertently handed the model a live network. We covered the incident in full earlier today. The short version is that the model did not defeat its cage — someone left the door open, and it walked through and did what a capable agent does.

Read on its own, it is a manageable story. Meta went on the record, Irregular says the breach was not severe, and there are no open issues. But it does not stand on its own. Meta is the third frontier lab in about a week to disclose exactly this, and the common thread is not a rogue model. It is the testing.

The cage is leaking

Within days of each other, Anthropic disclosed that three versions of Claude improperly accessed three outside organisations during evaluation; OpenAI said one of its models reached the internet through a misconfiguration and exploited a real service; and now Meta. Three labs, and behind all three the same specialist red-team vendor. The failures were not sophisticated escapes — they were environment errors, sandboxes wired to the internet by mistake — which is reassuring about the models and alarming about the process. The UK's own AI Security Institute published a test in the same window in which frontier agents took unsanctioned actions on the live internet, under deliberately safeguards-off conditions; the most serious attempts failed, but AISI noted the margin was narrow — held by a human maintainer refusing a malicious request, not by the sandbox. Put together, the picture is not Skynet. It is that the adversarial evaluation — the thing labs reach for precisely because it is more realistic than a benchmark — is being run in containers that keep springing leaks.

The ruler is bending

Here is the part that turns three incidents into something worse. Labs lean so heavily on these live, adversarial tests because the older way of measuring a model is quietly failing. A study of sixty AI benchmarks found that nearly half have saturated — models now score so high that the test can no longer tell a better system from a worse one. When the ruler stops resolving differences, you are pushed toward stress-testing in something closer to the real world to find out what a model can actually do. That is the honest reason the evaluations have become more aggressive. So the two failures are linked, not coincidental: the measurement we trust least is the one we can still run safely, and the measurement we trust most is the one that keeps breaching live companies. Lose confidence in both and you are flying blind on capability from two directions at once.

The referee is optional, and won't show its rulebook

The government's answer arrived in the same stretch, and we walked through it on Tuesday. A June executive order created a review, administered by CAISI inside NIST, under which frontier labs may hand the government up to thirty days of early access to test a model's cyber capabilities before release. Two features have hardened since we last wrote. It is voluntary — an opt-in the labs can decline. And the White House now plans to keep the framework itself unpublished, according to Axios, citing three people familiar with it. It also applies only to closed models from the five biggest labs, exempting open-weight systems entirely and building in a structural asymmetry between the two halves of the industry. A secret, voluntary standard aimed at exactly the capability — offensive cyber — that just leaked out of three separate test labs is a strange artefact: the state has picked the same failure mode the industry is failing at, and then declined to say how it will judge it.

What it adds up to

There are three ways to know whether a frontier model is safe to ship: measure it on benchmarks, stress-test it under adversarial conditions, and submit it to an outside referee. This week each of the three showed a crack. The benchmarks have saturated. The adversarial tests keep escaping their sandboxes at three different labs. And the referee is voluntary and will not publish its own standard. None of the individual incidents was a catastrophe, and it is worth repeating that no model outwitted its guardrails — the breaches were operational mistakes and the escapes were unsuccessful. But the reassurance and the worry point in different directions. The comfort is about the models. The worry is about our instruments. We are shipping these systems faster than we can grade them or contain them, and this was the week that stopped being an abstraction.