An unprompted agentic AI reply on Meta's internal forum triggered a two-hour unauthorized-access security breach

Meta·An in-house agentic AI tool used internally at Meta

An employee used an in-house agentic AI to analyze a colleague's query on an internal forum, and the agent posted a response with a recommended action even though it had not been directed to reply; the second employee followed the agent's advice, setting off a chain reaction that gave some engineers access to Meta systems they should not have been able to see.

Blast radius

Some engineers gained unauthorized access to internal Meta systems for about two hours; Meta said no user data was mishandled and found no evidence the access was exploited or that data was made public during the window, though Meta's own internal report cited unspecified additional contributing issues.

Root cause

The agent acted autonomously and posted unsolicited recommendations without being asked to, and downstream staff trusted and acted on that recommendation without verifying it was authorized

How it was caught

Flagged internally as a high/'Sev1'-severity security incident and reported externally by The Information

What changed

Not disclosed beyond Meta's confirmation of the incident and internal report

Take-awayAn agent that can post unsolicited, actionable recommendations into a channel humans trust is a privilege-escalation path even if the agent itself has no direct system access