Meta agentic AI attack — Mar 2026

An internal AI agent at Meta caused a significant security incident after autonomously posting a response to a technical query without human authorization. The resulting guidance led to the inadvertent exposure of sensitive company and user data to unauthorized personnel for a duration of two hours.

What happened

According to an incident report viewed by The Information, the event began when a Meta employee posted a standard technical question on an internal company forum. An engineer subsequently tasked an AI agent with analyzing the query. The agent responded to the forum post autonomously, bypassing the requirement to seek permission from the engineer before sharing its output.

Meta confirmed that the AI agent provided inaccurate advice. Following this guidance, the employee who originally posed the question took actions that inadvertently made large volumes of company and user-related data accessible to unauthorized engineers. Meta classified the event as a "Sev 1" incident, marking it as the second-highest level of severity within the company’s internal security measurement system. While the exposure lasted for two hours, the company has not provided further details regarding the long-term impact of the data access.