Incidents involving AI agents from OpenAI, Anthropic, Meta, and Google trace back to the same Irregular cybersecurity test setup, according to Irregular cofounder Omer Nevo. He told The Verge that the evaluation gave agents unintended internet access while a fictional target name overlapped with a real domain.
The disclosures arrived separately over the summer. Irregular says they describe runs of one evaluation scenario with a shared setup problem, rather than four unrelated test designs. That does not mean there was only one unauthorized action. Different models reached real sites during different runs.
How the simulated target became real
Irregular designs cyber exercises in which agents pursue targets inside a simulated environment. In its own account of the incident, the company says one scenario gave the model a fictional company name and internal addresses for the simulated target. The name also belonged to a real domain. Internet access was available in the test environment, so some models followed the name to the public site.
Irregular says models targeted that domain a limited number of times. After obtaining access, they took actions that included exploiting vulnerabilities, extracting credentials, and accessing a production database. In another run, a model reached a similarly named site and found publicly posted credentials. The company says the behavior appeared in fewer than one in 10,000 advanced simulations, often after hundreds of turns.
The two setup faults worked together. A name collision could have confused an agent, but network isolation would have stopped contact with the public site. Internet access alone would not explain why that particular site looked like a target. Irregular says it has disabled the affected evaluation and tightened access checks, monitoring, manual review, and agreement with partners on how each test is configured.
Where the shared explanation ends
Nevo told The Verge that the Irregular incidents involving the four labs came from the same underlying issue. The article says the separate OpenAI incident involving Hugging Face and incidents at the UK’s AI Security Institute had different causes. Irregular’s statement also says it found no evidence that a customer’s own systems were breached or its data leaked. That statement concerns Irregular’s customers; it does not erase the reported access to outside organizations’ systems.
The Verge reports that OpenAI and Anthropic disclosed their cases, while the Meta and Google cases first became public through media reports. Nevo said all of the Irregular incidents had been disclosed, but the article could not establish whether he meant disclosure to clients, affected parties, or the public. Irregular says it notified affected parties and plans a broader report on safer cyber evaluations.
