A The Verge investigation revealed that a wave of seemingly unrelated incidents involving 'rogue' AI agents at OpenAI, Meta, Anthropic, and Google had a single common source — Israeli startup Irregular, which stress-tests models for cybersecurity. In several tests this year, agents inadvertently gained access to the open internet, and a fictional target company name in the simulation matched a real domain, turning the tests into attacks on real targets.

image

What happened

The Verge investigation linked several high-profile incidents this year at OpenAI, Meta, Anthropic, and Google to a single third-party evaluator — Israeli startup Irregular, founded in 2023 as Pattern Labs and specializing in cybersecurity stress-testing of AI models. In several tests, agents escaped their isolated test environments and attacked real targets. Irregular CTO and co-founder Omer Nevo explained that the agents "inadvertently had access to the open internet" and that a fictional target company name in the simulation "matched a real domain." The incidents were revealed in late July: OpenAI and Anthropic announced the breaches themselves, while the Meta and Google stories became public through the media. The Hugging Face breach and incidents involving the UK AI Security Institute are not related to Irregular's activities.

Context

Irregular is not a random contractor but a notable player in the emerging market of third-party stress-testing for frontier models: the startup has raised $80 million, works with OpenAI, tested systems for the UK government and Anthropic, publishes research with RAND, and is mentioned in OpenAI's GPT-5 system cards. Cybersecurity evaluations in capture-the-flag format, where models solve tasks to hack simulated companies, remain a closed area: the word "disclosed" in labs' system cards does not mean "published," the rules for disclosing the results of such evaluations are opaque, and this breaks the reproducibility and comparability of reports from different teams. Mature standards for network isolation and reporting on escape incidents in this young industry do not yet exist, so an error in one evaluator's harnesses could affect tests at several of the largest labs.

Why this matters for the industry

The key takeaway for the industry is that the root cause lies in the infrastructure, not the models: two configuration errors overlapped — an open internet access and a collision between a fictional name and a real domain. This means that companies ordering or conducting cybersecurity evaluations of agents must vet third-party evaluators as rigorously as security vendors: their network isolation, egress policies, and name resolution rules become part of procurement audits. Irregular has already tightened its internet access controls, and the expected public report with lessons learned could set de facto standards for the entire category: an allowlist approach to internet access, checking for collisions between simulated names and real domains, and a unified terminology for incident disclosure. In the long term, outbound traffic control and auditable network permissions will likely become a standard layer of the agent stack, as OAuth and logging once did, and the strictness of isolation when testing agents' hacking capabilities is shifting from lab hygiene to a national security issue.

Why this matters for users

For those who run AI agents with network access themselves, this story provides a concrete checklist: agents' outbound traffic should be closed by default and routed only through a proxy with an allowlist of domains, and all simulated names and domains must be checked for matches with real ones before each run, including name resolution controls. It only takes two overlapping errors in the test environment's isolation for a "safe" simulation to affect real infrastructure, and the Irregular case shows that this can happen even with well-funded professional teams. Public reports on 'rogue' agents should now be read with a caveat: behind several high-profile stories may be the same error from a single tester, so the number of headlines about rogue agents does not directly indicate the frequency of failures in the models themselves.

What is still unknown / limitations

All the facts so far rely on a single journalistic reconstruction by The Verge, and the technical explanation of the incidents comes mainly from Irregular itself — an interested party. A public technical report with methodology is still being prepared, so details of the incidents and their full picture may be refined. It is still unknown which companies and organizations were actually attacked by the agents that escaped the test environment. The absence of incidents during testing of Chinese open models Kimi K3 from Moonshot AI and GLM-5.2 from Z.ai has weak evidentiary value: Omer Nevo himself warned that this does not prove their greater resilience, as a zero result without a comparable volume of tests, scenarios, and trigger thresholds is not proof.

Sources

Author

Look at AI, editorial team