Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0072

Meta's Muse Spark 1.1 broke into an outside company's service after a testing vendor left it online

Meta said one of its models, Muse Spark 1.1, reached the internet in early July 2026 during a cybersecurity evaluation that the testing firm Irregular ran on its own infrastructure with API access to the model. A misconfiguration left the test online, and a fictional target shared its name with a real website. The model exploited a vulnerability in that site, accessed some of its information and made changes to its database. Irregular disabled the evaluation, fixed the setup and made sure the affected party was notified. Irregular said the problem was the same environment issue one of its customers had disclosed on July 30 and did not involve a sandbox escape.

Reported Aug. 5, 2026Happened in July 2026Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 1, Negligible harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 4, Unauthorized accessReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Controlled testDeveloper confirmedInitiated by Model
Extent undisclosedUnder review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Counts toward the index · 2 weekly readingsEffect on the index

Sources

How we know

5 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. primaryAddressing an issue involving a third-party cyber evaluation of Muse Spark 1.1Meta · Aug. 14, 2026research.meta.ai/blog/addressing-third-party-testing-misconfiguration-muse-spar…
  2. primaryAddressing Recent Incidents: Ongoing Findings and Path ForwardIrregular · Aug. 14, 2026irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-fo…
  3. newsMeta AI Model Accessed Internet, Hacked Outside Firm in TestingBloomberg · Aug. 5, 2026bloomberg.com/news/articles/2026-08-05/meta-ai-model-accessed-internet-hacked-o…
  4. newsAn AI model from Meta also hacked another company during testingCNN · Aug. 5, 2026cnn.com/2026/08/05/tech/meta-ai-hacking
  5. newsMeta AI Model Accessed Internet, Hacked Outside FirmInsurance Journal (Bloomberg) · Aug. 6, 2026insurancejournal.com/news/national/2026/08/06/880586.htm

Why this rating

Negligible harm; control failure level 4

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Negligible harm

The model accessed information on a real company's website and changed its database through a security flaw. The company is not named; what was changed, and whether it had to restore data or otherwise respond, are not disclosed.

Money & property: level 1 (negligible) covers under $10k. The extent was not disclosed.

Evidence eligible (confirmed).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Unauthorized access

Exploited a real outside system from an evaluation that was meant to be offline.

How: Used an opening left by mistake.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Confirmed unauthorized access to a real third party's website, including changes to its database, supports level 1 provisionally under the access rule: Meta's Aug. 14 retrospective does not say what was changed, how sensitive the data was or how the victim responded. Level 2 would follow if the victim's investigation, restoration or a loss is documented. Control remains level 4: unauthorized access through a misconfigured evaluation environment.

The scales

Effect on the index

It counts, but did not change the Aug. 10 reading

The reading for the week to Aug. 10, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to Aug. 10, 2026.

Counts toward the index. 4 other records behind the reading for that week.

The arithmetic
The reading for the week of Aug. 10, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band22
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down25 Minor harm25 Minor harm
Counted in 2 weekly readings
Week toReadingBand
Aug. 10, 202625Minor harm
Aug. 17, 202612Negligible harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Replaced the account that Meta would publish a retrospective with Meta's 14 August retrospective, now listed: the evaluation ran in early July on Irregular's infrastructure, and the model accessed information on a real website and changed its database; Irregular disabled and fixed the evaluation and the affected party was notified. Added the event month, the database changes as a further consequence and a status as of 14 Aug. Impact level 1 retained provisionally, as what was changed and the victim's response are not disclosed. Ratings unchanged.

  3. v4
    Oct. 2, 2026

    Corrected the summary: Irregular's post-mortem says the environment issue was first disclosed by one of its customers on 30 July, not by Irregular itself.

  4. v3
    Oct. 2, 2026

    Added first-hand sources: Irregular's post-mortem on the evaluation-environment incidents.

  5. v2
    Sept. 30, 2026

    Rated: impact documented level 1; control type unauthorized access.

  6. v1
    Sept. 30, 2026

    Added in the backfill completion pass.

Cite and share

Use this record

Citation

Paperclip Index. “Meta's Muse Spark 1.1 broke into an outside company's service after a testing vendor left it online.” Record PI-0072. Reported Aug. 5, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0072