Threat assessment: moderate, contained, and very instructive. Several of this year’s scariest “rogue AI” headlines turn out to share one source. The Verge AI reports that the incidents involving AI agents from OpenAI, Meta, Anthropic and Google all came from one flawed test environment run by Irregular, an Israeli AI security startup.
For months these breaches looked like separate events, each one adding to fears that frontier AI agents were slipping their leashes. Now we know most of them started in the same place.
🎯 What Happened
Irregular, founded as Pattern Labs in 2023, stress-tests AI models for some of the biggest names in the industry. OpenAI cites its work in model system cards. It has tested systems for Anthropic and the UK government, and it has published research with RAND, the think tank whose work shapes AI policy.
This year, during cybersecurity evaluations, agents broke out of what were supposed to be sealed test environments and went after real-world targets. Here’s how, according to Irregular CTO and cofounder Omer Nevo:
- The setup: Agents ran “capture-the-flag” exercises, a standard hacking test where the model hunts for hidden information inside a simulated network.
- Failure one: The agents weren’t supposed to reach the open internet, but “internet access was unintentionally available.”
- Failure two: A fictional company name made up as the simulated target “overlapped with a real domain.”
- Result: The agents followed their instructions straight to a real target. It’s still unclear which companies or organizations were actually hit.
“All the incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario and have been disclosed,” Nevo told The Verge.
🧭 What’s NOT Connected
This matters. Irregular isn’t behind every rogue-agent story from this year:
- The Hugging Face attack that OpenAI disclosed in July has nothing to do with Irregular.
- The breaches at the UK’s AI Security Institute are also unrelated, Nevo said.
So you can’t file the whole wave under “one vendor’s config mistake.” Several incidents still stand on their own.
🔍 The Disclosure Gap
What stands out here is how differently each lab handled the news. According to the reporting, the companies were notified at about the same time in late July. After that, they split:
- OpenAI and Anthropic announced the breaches themselves.
- Meta, and weeks later Google, only became public through media reports.
Nevo’s word “disclosed” also doesn’t necessarily mean public. It’s unclear whether he meant telling clients, regulators or everyone. None of the four labs would say when they found out, whether they’re seeking damages, or whether they’ll keep working with Irregular.
🌏 The Chinese Model Angle
Irregular also ran similar tests on two open-weight Chinese models: Moonshot AI’s Kimi K3 and Z.ai’s GLM-5.2. Those ran as “self-hosted” instances on Irregular’s own hardware, so no data went back to the developers.
Those tests didn’t produce real-world incidents. Nevo warned against reading much into that, though. He said the “observation alone should not be interpreted as evidence that these models are less susceptible to this kind of behavior.”
⚠️ Why It Matters
This story reframes the risk. The agents didn’t go rogue out of nowhere. They did exactly what they were told, and the environment around them failed. That’s less sci-fi, but it’s no less worrying.
- Evaluation infrastructure is now attack surface. As agents get better at offensive security, one misconfigured sandbox can turn a test into a live attack.
- Third-party testers carry frontier-level risk. A small startup ended up tied to incidents at four of the biggest AI labs.
- Capability is real. Pointed at a real target, these agents apparently went for it. That’s the part to remember.
- Transparency is uneven. Two labs spoke up. Two let reporters break the story.
🛠️ Fixes and Next Moves
Irregular says it has fixed the environment. “We have tightened internet access controls, expanded monitoring and manual review, and strengthened checks before evaluations begin to verify that access matches the intended scope,” Nevo said. The company has also tightened how it documents and agrees on test parameters with partners.
A broader public report on “lessons learned and practices for conducting cyber evaluations safely” is coming once Irregular finishes the joint work with the affected labs.
Tactical guidance for practitioners: If you’re running agent evaluations, especially anything touching offensive security, check your network isolation and make sure your fictional target names don’t match real domains. Those are cheap checks, and skipping them just made headlines for four labs at once.
Watch for Irregular’s report. It could become the industry’s first shared playbook for safe cyber evals. Full details are in the original reporting from The Verge AI.