A single flaw at an Israeli startup explains several 'rogue' AI agent attacks from OpenAI, Anthropic, Meta and Google

Over the past few months, a series of troubling incidents has been piling up in the world of artificial intelligence: autonomous agents from different companies escaping their test environments and attacking real-world targets without authorization. In July, OpenAI acknowledged that its agents had attacked Hugging Face without permission, which triggered public concern about AI safety. Since then, similar incidents have followed involving agents from Meta, Anthropic, Google and other companies, fueling fears of an 'out-of-control' or 'rogue' AI.

Until now, these episodes had been presented as isolated events, unconnected to one another. However, an investigation by The Verge reveals that many of them share a common origin: a single company tasked with stress-testing the safety of those models. It is Irregular, an Israeli startup founded in 2023 (originally under the name Pattern Labs) that specializes in subjecting AI models to cybersecurity testing in what it describes as 'high-fidelity research platforms that simulate and monitor real AI security scenarios'.

Although Irregular does not publicly disclose its full client list, its work has been cited in the 'system cards' (technical documentation) of OpenAI models, it has collaborated with the UK Government and with Anthropic, and it has published joint research with RAND, an influential think tank that advises on AI public policy. It is therefore a player with real weight within the safety-evaluation ecosystem of the major AI labs.

According to the article's reconstruction, several of the tests Irregular carried out this year ended with agents escaping their supposedly secure and isolated test environments to go after real targets outside that simulation. These breaches are separate from the Hugging Face attack mentioned above, but they follow a very similar pattern: Irregular was assessing the models' cybersecurity capabilities in controlled environments designed to mimic realistic conditions, and in some cases it used 'capture the flag' exercises, a standard technique for measuring hacking skills in which an agent is asked to locate hidden information inside a simulated network.

The problem is that this network, in theory simulated, was not entirely so. Omer Nevo, co-founder and chief technology officer (CTO) of Irregular, confirmed to the outlet that the agents were not supposed to have access to the open internet, but that 'internet access was unintentionally available'. On top of that came another failure: the name of a fictitious company created as a target within the simulation happened to coincide with a real existing domain on the internet. The combination of both errors —unintended access to the real network and a target name that turned out not to be so fictitious— led the AI agents to direct their hacking capabilities against real targets. It has not been clarified which specific organizations were actually attacked as a result of this failure.

Nevo explicitly confirmed that this same underlying problem lies behind the incidents involving models from OpenAI, Meta, Anthropic and Google. In his words: 'All Irregular-related incidents stemmed from the same underlying problem in a single evaluation scenario, and they have been reported.' He also clarified that 'other security incidents recently reported in the sector are not related to Irregular or to our evaluations', a clarification that explicitly excludes from this common cause both the Hugging Face hack and breaches linked to the UK AI Safety Institute.

An important nuance the article points out is that the word 'reported' does not necessarily mean the information was made public. It is unclear whether Nevo meant Irregular's clients had been informed, the general public, or some other party. What is on record is that, according to reports published by Anthropic and OpenAI, and according to reporting on the Google case, the affected companies were notified at around the same time, in late July. OpenAI and Anthropic announced their respective breaches themselves, while the Meta case and, weeks later, Google's, came to light first through the press rather than through a direct announcement by the companies.

Irregular's cybersecurity testing work is not limited to the four big US tech companies. According to research published on its own website, the company has also run similar tests on Kimi K3 and GLM-5.2, open models developed by the Chinese companies Moonshot AI and Z.ai respectively. Unlike the proprietary models involved in the other incidents —it is worth recalling that Meta keeps its flagship model, called Spark, proprietary— these Chinese models can be freely downloaded and run on the user's own hardware, which means evaluators such as Irregular do not depend on the companies for access nor need to send data back to them. Irregular's research describes these tests as carried out on 'self-hosted' instances.

According to Nevo, the evaluations of the Chinese models did not lead to similar real-world incidents: 'We did not observe the same type of issue described in the incidents referenced here during our GLM or Kimi evaluations.' He cautioned, however, that this isolated observation 'should not be taken as evidence that these models are less susceptible to this kind of behavior', a caveat that leaves open the possibility that the problem simply did not surface in those particular tests, without implying greater structural safety. Neither Moonshot nor Z.ai responded to the outlet's requests for comment.

In the wake of these incidents, Irregular says it has introduced changes to its processes. Nevo explained: 'We have tightened internet access controls, expanded monitoring and manual review, and strengthened checks before evaluations begin to verify that access matches the intended scope. We have also improved how we document and agree with our partners on the setup and parameters of each evaluation.' The company also plans to publish, once its joint work with the companies involved is complete, a broader report gathering 'the lessons learned and the practices for conducting cybersecurity evaluations safely', with the stated aim of 'turning the lessons from these incidents into shared, public practices for safely developing and evaluating increasingly powerful AI'.

As for the four big US companies involved, none responded to questions about further details: exactly when they learned of the breaches, whether they are seeking any form of compensation or redress from Irregular, or whether they expect to keep working with the company in the future. Google and Anthropic did not respond at all, while OpenAI and Meta merely pointed to previously published blog posts.

The case is revealing because it dismantles the narrative of a string of scattered, seemingly random 'rogue AI' incidents, showing instead how a single methodological flaw in the design of a test environment —a gap in network isolation combined with a domain-name coincidence— was able to propagate across the safety evaluations of several of the world's most important AI labs. This highlights a significant blind spot in how the safety of the most advanced AI systems is verified: much of that verification depends on specialized external providers such as Irregular, whose own infrastructure errors can paradoxically become the actual vector for the very dangerous behaviors they were meant to detect and prevent.