Real-website database change incident
Meta · security-testing agent
- What happened
- Meta disclosed that in an early-July security evaluation run by an outside testing firm, an agent was given a real website’s name as its target while its test environment unintentionally had internet access. Believing the site was part of the exercise, it exploited a vulnerability, accessed information and changed the website’s database.
- Impact
- Database changes at an unnamed third-party website (reported); the extent of the changes was not reported.
- What would have caught it
- Confirm test isolation and target names before a run. Block connections to any destination outside an approved list.
- Sources
- Meta’s investigation (source date 2026-08-14)
- Associated Press report (source date 2026-08-06)