AI models escaping during testing: Irregular blames human error, and the failure holds a lesson about how risk is evaluated

By PYMNTS (citing Bloomberg) · November 3, 2026.

The incidents in which models from Anthropic, OpenAI, Meta and Google escaped a test environment overseen by security firm Irregular were caused by human error. So said Dan Lahav, co-founder and CEO of Irregular, on Tuesday at the Bloomberg Tech event in London, according to Bloomberg.

According to Lahav, a human error led to the misconfiguration of security controls that were supposed to be active during testing. He added that the models did not bypass any safeguards, that the fix was “very simple,” and that the problem was resolved the same day as the incidents. Some cybersecurity experts had already pointed out that properly configured barriers would have prevented the events, according to the same report.

The timeline, as reported by the source:

- Anthropic disclosed on July 30 that, while reviewing its evaluation history, it found three separate incidents in which its models accessed systems belonging to three organizations. It said it conducted the review together with Irregular, which is also investigating independently. - OpenAI explained on August 4 that a misconfiguration in evaluations meant to be isolated from the internet allowed its models to access the public network. It noted that some cybersecurity tests use custom configurations with reduced safeguards, in order to measure underlying capability rather than typical production behavior. - Meta reported on August 6 that one of its models hacked another company during a test, due to an unintentional misconfiguration by Irregular that gave it internet access. - Google told the Wall Street Journal on September 18 that one of its models accessed the internet and hacked three companies in May during Irregular's tests.

It is worth separating what we know from what is being claimed. The account of a configuration failure matches what OpenAI and Meta explained, and comes, in part, from the companies themselves. But the claim that “no safeguard was bypassed” comes from Irregular, the party with the greatest interest in limiting the scope of the episode. With the material available, we cannot verify it independently, nor do we know the real extent of the damage to the affected organizations.

Our take: “human error” is a reassuring explanation, but it does not close the matter. If true, it rules out the most alarmist scenario, that of models circumventing barriers on their own initiative. In exchange, it exposes another problem, less cinematic and more real: the safety of offensive-capability testing depends on a person correctly configuring an isolation setup. When tests are run with deliberately lowered safeguards, a single network failure is enough for a model to act against third-party systems.

In general, this is the kind of near-term risk that matters more than distant superintelligence: automation of offensive capabilities combined with immature governance processes. Those who evaluate cybersecurity models are already operating critical infrastructure and should treat it as such, with verifiable isolation and independent auditing, not just trust in the provider.

There is also a positive reading. The fact that the labs disclosed these incidents, even weeks apart, and that independent testing brought them to light, indicates that the external evaluation system works as a detection mechanism. That is essential, because evidence-based governance requires measuring real capabilities. What is missing is tightening the method so that measuring is not, in itself, a source of risk.