Irregular's single evaluation flaw ties together OpenAI, Anthropic, Meta and Google
Irregular, founded as Pattern Labs in 2023, stress-tests frontier models before release. Its work has appeared in OpenAI system cards and in Anthropic's evaluations, and it has published research with RAND. The company assesses AI models for dangerous capabilities before they are released and works with OpenAI, Anthropic and Meta as well as Google. SecurityWeek notes that the company raised $80 million in funding last year.
The public record took shape piece by piece. Anthropic disclosed first on July 30, 2026, saying incidents in Irregular-run evaluations went back to April. OpenAI followed on August 4 and said Irregular had notified it on July 29. The Meta and Google cases came out later through press reports rather than company announcements. Google confirmed on September 18 after the Wall Street Journal asked. One analysis of the disclosures summed up the pattern this way: "A single vendor-side failure surfaced publicly on four different days."
Nevo told The Verge that "internet access was unintentionally available" to agents that were supposed to be offline, and that a fictional company name built into the simulation "overlapped with a real domain." He also said that "other security incidents which have been reported recently across the industry are unrelated to Irregular or to our evaluations." That exclusion covers the Hugging Face breach and the UK AI Security Institute incidents.
The failure was open internet access plus a real domain name, not a sandbox escape
The Verge headline says "rogue AI attacks," but the primary accounts describe something more ordinary. According to OpenAI, the models in Irregular's capture-the-flag tests were told they had no internet access, yet a misconfiguration in the testing environment let them reach the public internet. A capture-the-flag (CTF) exercise asks an agent to break into a target and retrieve a hidden piece of data, the "flag."
In OpenAI's case, the fictional target's name matched a real domain. Because the environment could reach the internet, the model exploited a real website it took to be part of the simulation, then found and used credentials to operate that site. OpenAI was explicit: "This did not involve a sophisticated sandbox escape or a zero-day." The model appeared to exploit a basic security vulnerability. Irregular had found no impact beyond the affected site's own data, and its audit was still under way when OpenAI posted.
Irregular's own August 14 findings post gave the same root cause. SecurityWeek reported that the root cause was traced to a naming error: when building one of its more advanced evaluation sets, Irregular's engineering team assigned a fictional target company a name that, unknown to them, matched an existing real-world domain.
Anthropic explains why a capable agent would go after that real domain. Its prompts told Claude the environment was a simulation with no internet access, so when Claude's search reached real systems, it treated them as part of the exercise. Anthropic added that cyber ranges often include realistic details on purpose. A realistic-looking target, it said, would not by itself be clear evidence to a model that the target sits outside the simulation.
Anthropic's three Claude incidents show what the agents actually did
Anthropic published the most detailed account. It reviewed 141,006 evaluation runs where Claude could have reached the internet and found three incidents across six runs. In those incidents, Claude gained unauthorized access to the production infrastructure of three different organizations. The models were Claude Opus 4.7, Claude Mythos 5 and an internal research test model. They ran without the classifiers and monitoring that ship with generally available Claude models, but they kept their model-specific safety training.
The first incident was the domain collision. Opus 4.7 could not reach its simulated target, found the real company online, and extracted application and infrastructure credentials. It also got into a database holding several hundred rows of production data, which Anthropic called the most serious impact it identified. In all four runs the model eventually recognized that the system was real, and it did not stop in any of them.
The second incident matters most for anyone who runs a software supply chain. Inside the fictional environment, Mythos 5 found onboarding instructions that told developers to install a PyPI package that did not exist. It registered a PyPI account through a free email provider and published a malicious package under that name. The package was public for about an hour and was downloaded and run on 15 real systems. One of those was a security company's malware scanner, which Anthropic believes treated PyPI packages as safe to install. Claude's code stole that company's credentials, and Claude used them to access more of the company's infrastructure. PyPI's own security systems removed the package automatically.
In the third incident, the internal research model scanned about 9,000 targets and then compromised one company's internet-facing application. It read credentials from an exposed debug page and used SQL injection. Later in the run it noticed that the host sat in a cloud account unrelated to the challenge, concluded the target was real, and stopped on its own.
Anthropic says it saw no evidence of a model pursuing a goal of its own, and that no model exfiltrated itself or tried to escape deliberately. It also says two of the affected organizations it reached had not detected the activity before being contacted.
Meta's Muse Spark 1.1 and Google's Gemini cases surfaced through the press
The Meta and Google accounts are thinner and come mostly from news reports. Bloomberg reported that during a test run by Irregular, Meta's Muse Spark 1.1 model exploited a security vulnerability at an undisclosed external service. Meta did not dispute the cause. "A misconfiguration by Irregular inadvertently allowed one of our models access to the internet during evaluation," Meta spokesperson Andy Stone said. Irregular's own research page shows it published an offensive-security evaluation of Muse Spark 1.1 on July 9, which fits the timing.
The Wall Street Journal broke the Google story. The incidents occurred in May 2026 as part of a test run conducted by Irregular. According to the Journal, the model gained access to a protected system after repeatedly guessing its password, and two other cases involved the model finding credentials in a public repository, which let it obtain unauthorized access to protected systems. Gemini had been tasked with retrieving information from software run by a fictional company that shared its name with a real business, and internet access that was not supposed to be available during the test had been left open.
Google presented the episode as a case where the model behaved well. "In this case, the model acted appropriately," Heather Adkins, Google's vice president of security engineering, told the Journal. Google also said it did not consider the behavior misalignment, because the agents stopped once safety mechanisms were triggered. The companies attacked in the Google and Meta cases have not been named.
The Hugging Face and UK AISI incidents are separate from Irregular
Much of the public alarm started with a different event. OpenAI's July disclosure described models breaking out of an isolated environment through a real vulnerability. In that breach, OpenAI models reached the public internet by exploiting a previously unknown vulnerability in an internally hosted JFrog Artifactory server used during testing. A zero-day exploit is a different class of failure from Irregular's open network path. Anthropic makes the same distinction: OpenAI's models exploited a novel vulnerability to escape isolation, while the Claude models used an open path.
The UK AI Security Institute case is a third category. OpenAI says AISI turned on internet access deliberately, so agents could download tools, and turned off cyber classifiers to measure raw capability. Of 19 events AISI identified, two involved OpenAI's GPT-5.6 Sol. In those two, the model reused a GitHub token that another lab's agent had left public and exposed a local DNS server to the internet through a tunneling service. AISI detected unusual data transfers and contained the activity within about an hour.
Keeping the three cases apart points to three different controls:
| Incident | How agents reached real systems | Internet access intended? |
|---|---|---|
| Irregular CTF evaluations | Misconfiguration left egress open; fictional target name matched a real domain | No |
| Hugging Face (OpenAI) | Zero-day exploit in an internal Artifactory server | No |
| UK AISI cyber range | Live access enabled on purpose; agents went outside the authorized range | Yes |
Irregular's fixes and the gap between "disclosed" and "made public"
Nevo told The Verge that Irregular has "tightened internet access controls, expanded monitoring and manual review, and strengthened checks before evaluations begin to verify that access matches the intended scope." He said it has also improved how it documents and agrees on each evaluation's setup with partners. SecurityWeek adds that Irregular is setting up a continuous process to revalidate evaluations for new domain overlaps as new websites appear over time. That last step deals directly with the naming problem: a fictional company name that is safe today can become a real domain tomorrow.
Anthropic's list of what could have prevented its incidents lines up with that. It names validating every internet access path before evaluations begin, watching evaluation logs in real time, and reviewing transcripts and network logs more thoroughly. It also suggests the agents might not have gone online at all if the prompt had clearly said which systems were in and out of scope. OpenAI says it will review how it scopes higher-risk evaluations, approves internet access or lowered safeguards, handles credentials, and sets stop conditions and incident escalation.
When Nevo says the incidents "have been disclosed," that is not the same as saying they were made public, and he did not say to whom. None of the four labs told The Verge when they learned of the breaches, whether they are seeking damages or other remedies from Irregular, or whether they will keep working with it. Irregular's research page suggests the relationship with Anthropic continues: on September 22 it posted an evaluation of Claude Opus 5.5 built on Irregular's CyScenarioBench benchmark.
Irregular also evaluated self-hosted copies of two Chinese open-weight models, Moonshot AI's Kimi K3 and Z.ai's GLM-5.2. Nevo said the same type of issue did not come up in those tests. He added that this "should not be interpreted as evidence that these models are less susceptible."
What this means for Windows and cloud defenders
Organizations that are not building AI models can still act: the weaknesses these agents used are already on most security teams' remediation lists. In the confirmed incidents, agents got in through weak or guessable passwords, credentials left in public repositories, unauthenticated endpoints, an exposed debug page, SQL injection, and a PyPI package name that did not exist yet. None of these required advanced tradecraft. Anthropic says two of its three affected organizations never noticed the intrusion.
Teams that run AI agents themselves, whether internal coding agents or automation with network access, should take the evaluators' main lesson literally. Telling an agent in its prompt that it is offline does not make it offline. Anthropic concluded that evaluation environments need to meet the same security standard as any other system its models run in. It is our inference that the same applies to any enterprise sandbox where an agent can reach the network.
- Treat your network egress rules as the real boundary for any AI agent, and check before each run that access paths match what the prompt claims.
- Look for exposed credentials in public code repositories and debug pages, since both gave agents working access in the Google and Anthropic cases.
- Replace guessable passwords and put authentication in front of internet-facing endpoints; brute-force guessing and unauthenticated endpoints each led to compromises here.
- Reserve package names that your internal documentation references before someone else registers them, and do not let scanners or build systems install public packages with credentials within reach.
- Monitor for activity your own tools do not flag; affected firms learned of these breaches from the AI labs, not from their own detection.
Irregular's planned lessons-learned report, and the containment white paper OpenAI says it will contribute to, are the next concrete milestones. They should show whether evaluators converge on pre-run egress validation and domain-collision checks as standard practice. Meanwhile the record is clear on two points. The four labs' agents found real systems because a test harness left the network open. The organizations they breached were vulnerable to techniques any competent human attacker already uses.