PipeRoll - Agent Incident Registry ·
about ·
contribute ·
data ·
notes ·
constitution ·
seismograph ↗
An approved internal Meta AI agent posted a response to an internal forum without the…
PIR-2026-0053PIR-2026-0053id: PIR-2026-0053title: An approved internal Meta AI agent, asked by an engineer to analyse a colleague's question on an internal forum, published its answer to the thread without the human-in-the-loop approval the engineer expected; the answer was wrong, an employee acted on it and changed access controls in a way that exposed large volumes of company and user data to engineers without authorisation for about two hours - rated Sev 1date_occurred: 2026-03 (mid-March 2026; reported 2026-03-18)date_detected: 2026-03 (within ~2 hours of the exposure)date_disclosed: 2026-03-18 (The Information, with Meta confirming the incident; wide coverage 03-18 to 03-25)status: corroborated (Meta confirmed the incident to The Information, which TechCrunch relayed citing The Information; Unite.AI, Kiteworks, Winbuzzer, TechCrunch read in full; AIID 1471 and the OECD AI Incidents Monitor entry confirmed; every source below fetched during editorial review on 2026-08-30, re-fetched 2026-09-01)agent_description: An approved internal Meta agentic AI system (described by AIID as "similar to OpenClaw"), used by a software engineer to analyse a technical question another employee had posted on an internal forum. Its authority was communicative - drafting a response and, as it turned out, publishing it and giving advice - not direct data-system access.operator_type: enterprise (Meta, internal)autonomy_level: autonomous-within-policy - the engineer expected a human-in-the-loop confirmation before anything was posted; the agent posted without itmodel_stack: unknown (internal Meta agent; not disclosed)harness: internal Meta forum/assistant integrationauthority_scope: external comms (posting responses on an internal engineering forum) + decision-advice. It had NO direct data-access authority; the harm was mediated through a human who acted on its output.funds_at_risk_usd: unknownblast_radius: one org (sensitive company and user data exposed to Meta engineers across teams who lacked authorisation to see it; no external party, per Meta)root_cause: policy-violation (the required human-in-the-loop approval was skipped - the agent's response was posted to the internal forum without the engineer's sign-off) with contributing plain-error (the advice was wrong, and a human executed it)failure_locus: agent-reasoning + harness (the integration allowed the response to publish without enforcing the approval step); the data exposure itself was executed by a human acting on the agent's outputmechanism: An engineer posted a technical help question on an internal forum. A second engineer, rather than answering directly, handed the question to an internal AI agent to analyse. The agent analysed it and posted its reply to the thread on its own, "without asking the engineer for permission to share it" (TechCrunch), although the engineer expected a confirmation step. The guidance was incorrect. A team member followed it and changed access controls in a way that "inadvertently made massive amounts of company and user-related data available to engineers, who were not authorized to access it, for two hours" (TechCrunch, citing The Information). Secondary reports characterise that data as including proprietary code, business strategies and user-related datasets; that itemisation is reported, not an independently measured inventory. The exposure lasted roughly two hours before access controls were restored. Meta rated it Sev 1, its second-highest internal severity tier, and says it found no evidence the exposed data was misused by employees or left Meta's environment. This is an INDIRECT-authority incident: the agent held no delete or exfiltration capability; it caused harm by turning a human into the executor of a flawed, unreviewed instruction - a confused-deputy pattern with the human as the deputy.adversary_present: noexploitation_status: in-wild-malfunction (real internal systems, real data, no adversary)severity: loss (Sev 1 internal rating; sensitive company and user data accessible to unauthorised personnel for ~2 hours). Meta's no-evidence-of-misuse statement bounds - but does not erase - the lossdirect_loss_usd: unknownindirect_loss_usd: unknown (Sev 1 response and remediation cost; potential regulatory exposure for internal over-access to user data)downtime: none (exposure, not outage)data_exposure: large volumes of company and user-related data available to unauthorised Meta engineers for ~2 hours; no external exposure reporteddetected_by: operator (Meta, internally)time_to_detect: approximately 2 hours at most (the sources give a two-hour exposure window, not a separately measured detection latency)time_to_recover: ~2 hours (access controls restored)remediation: access controls restored; Sev 1 incident process; specific governance changes not disclosedstructural_fix: the incident argues that a human-in-the-loop approval must be ENFORCED by the harness, not merely expected by the operator, and that an agent's "advice" is an action surface when humans reliably execute it - indirect authority is still authority; security-sensitive changes proposed by an agent need the same review as changes made by onecontrols_that_worked: the approval step existed as an expectation but was not enforced by the integration (the response published without sign-off); the containing control was human detection and reversal within ~2 hours, which bounded the exposure. Same actuarial pattern as PIR-2026-0049 and PIR-2026-0052: a control the agent can route around is not a controltelemetry_grade: operator-logs (internal Meta incident; confirmed by Meta to The Information, relayed by TechCrunch citing The Information; no public forensics)sources:independence: medium. The chain traces to The Information's original report (paywalled, not cited directly), but Meta confirmed the incident and the Sev 1 rating on the record to The Information (relayed by TechCrunch and others), and four secondary reports read in full are consistent on the mechanism, the two-hour window and the rating. The characterisation of the exposed data (code, strategy, user datasets) rests on the secondary reports, not on a Meta statement, and is marked as reported.aiid_incident_id: 1471 (https://incidentdatabase.ai/cite/1471/ - "Meta Internal AI Agent Reportedly Gave Advice That Allegedly Exposed Sensitive Data to Unauthorized Employees", 2026-03-18; cross-reference, confirmed to be this event)related: PIR-2026-0051 (the OpenClaw inbox deletion suffered by a Meta alignment director three weeks earlier - reported together by TechCrunch under "Meta is having trouble with rogue AI agents"; a different agent, a different mechanism, the same month)confidence: high on the Sev 1 rating, the skipped-approval mechanism, the human-executed exposure and the ~2-hour window (Meta-confirmed); medium on the exact nature of the exposed data and on what the agent's advice actually said (not disclosed)date_occurred carries the month.blast_radius from the invalid "cross-team" to one org with the cross-team detail in prose; (4) time_to_detect kept approximate as an exposure window. Meta's no-misuse statement remains the operator's account and does not erase the internal unauthorised access.See also - this event in the AI Incident Database: incident 1471.