The WISPer Report

Part of my job as researcher is to keep track of what's current in cybersecurity. The other part of my job is to translate that technobabble into plain English for the layperson, because public awareness and education in the digital age has been deliberately gutted.

Posts made here are simultaneously uploaded on LinkedIn and Reddit as well, and our company has plans to expand our online presence further.

Of Note:

I currently have the askbox anon on. Play nice, or lose the privilege. Same goes for reblogs and replies. This is a professional space, please act accordingly. This is not customer service and I can and will block with impunity.

Don't expect me to take anything at face value. I'm a researcher, my job is fact checking.

I will check this blog daily as I update it. Any questions in my inbox will be answered at that time.

About Me:

I've worked for WISP since 2021, starting as a student, then intern, and learning up the ladder to my current position as forensic analyst.

I come to cybersecurity via the life sciences. I have a degree in Biotech that's been remarkably handy in my current job. I am older than the internet. I remember when computers were still in monochrome and had no mouse. I have watched my industry be born.

I am anti-censorship and anti-generative AI. I have a private life that I endeavor to keep private. But I feel comfortable enough to share that I am the parent of one child and two cats. I play video games. I enjoy my work that is essentially 'sort, sort, arbitrarily sort'. Of course I have blue hair and pronouns (she/her), I work in Infosec.

The trend in the last few weeks has been AI security testing running amok. I’ve covered the GPT-5.6 Sol breach of Hugging Face, and Anthropic’s voluntary review of their agentic tools to find unauthorized behavior. Just yesterday I covered AISI’s report on the two companies’ tools taking autonomous actions during testing. Now Meta has admitted that during an independent evaluation, conducted by Irregular, their AI broke containment. Their Muse Spark 1.1 model carried out the breach of an undisclosed organization’s systems and made unauthorized changes to its internal environment.

This is the second time Irregular has been at the heart of a containment escape. They were also involved with the Anthropic case, where a ‘misunderstanding’ between the two companies led to Opus 4.7, Mythos 5, and an unnamed internal research test model gaining internet access. This time the culprit is allegedly a misconfiguration in the test environment, leading to the same access to the open internet. As of publishing, it’s not clear if this was due to a known flaw or a zero-day. Meta says they are investigating and will provide a ‘full retrospective’ once they have all the facts.

Back to back incidents involving the same third party partner may be a coincidence, but I think it’s more likely that Irregular either doesn’t follow directions well or is simply in over their heads in terms of capability. I’m not alone in that assessment. Experts in the industry are criticizing the levels of competition evidently going around as tech giants tout their models as the most powerful, according to Infosecurity Magazine’s article on the subject. Alex Goller, Principal Solution Architect EMEA at Illumio, is paraphrased as saying that this series of similar incidents among the biggest players is getting ridiculous. And it is. The pattern emerging is one of willful negligence in security standards in order to make the biggest splash. Meanwhile real people and businesses are being targeted and you can be sure that actual threat actors are paying attention to how it’s being done.

Test environments are supposed to be isolated and monitored. That is the point of testing, after all. To see the results as they’re happening. What is instead occurring is the discovery of unauthorized activity by these tools after the fact. These aren’t isolated incidents anymore; they are a failure to execute baseline checks and balances with the proper oversight. I said in my report on the Hugging Face incident that OpenAI was lucky they were willing to work together to remediate the issue. How long is that tolerance for what amounts to AI-driven cybercrime going to last?

To be clear, this is not a case of AI tools intentionally choosing a life of crime. But with guardrails against these kinds of actions taken down for evaluation purposes...well, the models see every option as viable and part of the scope of their task, including credential harvesting, privilege escalation and exploitation of vulnerabilities. Yes, it’s important to know what unchecked AI tools can do; it gives tangible data in how to protect systems from exactly this kind of incursion. But there needs to be more (or just some) forethought in how they’re allowed to do it. What we are seeing right now is live activity carried out against real people and entities without all the variables accounted for, or informed consent from these possible victims. It’s sloppy. The next company to get hacked may not be so forgiving. And rightly so, in my opinion.