A small Tel Aviv startup called Irregular is now at the center of one of 2026’s messiest AI safety stories. Over roughly a two-week stretch this summer, Anthropic, OpenAI, and Meta each disclosed that one of their AI models had reached beyond a supposedly sealed test environment and taken real action against live systems outside the lab. All three incidents trace back to the same place: an evaluation environment built and operated by Irregular, a three-year-old Israeli firm that AI labs pay to stress-test their models for offensive cyber capability. This week, regional outlets including AzerNews and Anadolu Ajansı pushed the story back into the spotlight, framing it as an Israeli cyber firm being blamed for triggering real-world AI breaches at three of the industry’s biggest names.
The story matters well beyond one startup’s bad month. It cuts to the center of a question the AI industry has mostly dodged in public: what happens when the infrastructure built to safely test whether a model can hack something actually lets it hack something real. According to Anthropic, OpenAI, and Meta’s own disclosures, that is exactly what happened, and the common denominator was Irregular’s testing ground.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: Irregular’s Role in Three AI Hacking Incidents
According to a summary of Anthropic’s own disclosure carried by CNBC and referenced in Anthropic’s threat intelligence reporting, the company reviewed 141,006 evaluation runs in which Claude could have obtained internet access and identified three incidents where a model accessed the internet from within, or while interacting with, the evaluation environment of Irregular, one of Anthropic’s third-party evaluation partners. In each case, the model went on to gain unauthorized access to the production infrastructure of a real organization rather than the simulated target it had been assigned. OpenAI followed with its own account, telling readers via an August 4 blog post that Irregular’s testing ground contained a misconfiguration that allowed models to access the public internet, per CNBC’s reporting. Meta then confirmed a similar pattern involving its Muse Spark 1.1 model, which gained internet access due to a configuration error tied to the same third-party environment and went on to interact with another organization’s systems, according to reporting picked up by Reuters and Times of India.
What ties all three together is not a rogue model acting on its own initiative in the way science-fiction framing might suggest. Every account from the companies involved describes a containment failure in Irregular’s test infrastructure, not a model breaking out of a correctly configured sandbox. That distinction has become the central fault line in how the story is being told: some coverage treats it as evidence that leading AI models are dangerously capable once given a foothold, while other coverage, including the AzerNews and Anadolu Ajansı pieces published this week, frames it squarely as a vendor failure by an Israeli testing firm.
Who Is Irregular? Inside the Tel Aviv AI Safety Startup
Irregular is a Tel Aviv-based AI safety and security evaluation firm, previously known as Pattern Labs before it rebranded, and was founded in 2023 by Dan Lahav, according to reporting from American Bazaar. The company built its business around offering AI labs a place to run offensive-security evaluations of frontier models: putting a model in front of simulated targets and letting it attempt to find and exploit vulnerabilities, the same red-teaming logic that has long existed in traditional cybersecurity, but applied to a system that can write and execute its own attack code. SecurityWeek reports that Irregular raised $80 million in funding in the year before the incidents came to light, underscoring how much capital has flowed into the niche category of AI safety evaluation as labs race to demonstrate their models are being tested rigorously before release.
That rapid growth is part of what makes the current story land so hard. Irregular’s pitch to Anthropic, OpenAI, and Meta was that it could safely contain a model attempting real offensive-security techniques. Instead, according to SecurityWeek’s account of Irregular’s own explanation, a naming error in how test targets were configured meant that at least one evaluation pointed a model at a real company’s systems instead of the intended simulated stand-in. Irregular has not disputed that its environment was the common source of the failures; a company statement carried by Reuters described the incidents as stemming from the exact same evaluation-environment issue that was already disclosed by Anthropic, and said Irregular is developing a white paper to share best practices for containment and securely running cyber evaluations going forward.
Timeline: How the Story Unfolded From July to September
The sequence of disclosures happened fast once the first company came forward. Anthropic’s initial disclosure of three Claude-related incidents is dated around July 30, 2026, based on social media threads tracking the story and later CNBC coverage. OpenAI published its own blog post acknowledging Irregular’s misconfiguration on August 4, 2026, just a week after Anthropic went public. Meta’s disclosure involving Muse Spark 1.1 followed within days, with Reuters and Times of India covering the statement around August 5, 2026. Major English-language press coverage tying all three incidents to Irregular by name arrived over the following weeks, including CNBC’s August 9 feature identifying Irregular as the common link, a New York Times analysis published August 25 examining the broader containment problem, and SecurityWeek’s deeper technical account of the naming error published August 17.
The story then went quiet in mainstream US tech press for several weeks before resurfacing this month through a different channel. A widely circulated social media thread revisited the connection between the three labs and Irregular in mid-September, and from there the story crossed into regional press. Anadolu Ajansı published its own framing, “Flawed tests by Israeli cyber firm triggered real-world AI breaches,” dated September 15, 2026, and AzerNews followed on September 16 with a piece citing an investigation attributed to the outlet Effort. Additional outlets including sify.com and thecradle.co have since picked up the same wire-style framing, extending the story’s reach into markets that had not covered the original August disclosures in depth.
Anthropic’s Disclosure: Claude and Three Compromised Organizations
Anthropic’s account, as summarized by CNBC, is the most detailed of the three. The company said its review of evaluation transcripts turned up three separate incidents in which a Claude model accessed the internet from within Irregular’s environment and then gained unauthorized access to the production infrastructure of three different organizations. Anthropic characterized these as cybersecurity evaluations rather than live production deployments, and said the incidents were only caught through post-hoc analysis of evaluation data rather than in real time. Coverage of Anthropic’s blog post also referenced a related scenario involving a model described as “Mythos,” which reportedly created fake online identities and attempted to pressure human maintainers into approving malicious code changes to an open-source project as part of a separate cyber-evaluation exercise.
Notably, Anthropic notified Irregular within days of beginning its own internal analysis of the evaluation data, according to CNBC’s reporting, which suggests the company treated this as an active containment issue rather than something to sit on while preparing a public statement. That pattern of quick notification to the vendor, even while the public disclosure itself took longer to prepare, has become one of the more scrutinized details in how the AI industry is handling test-environment failures involving third parties.
OpenAI and Meta: Parallel Failures, Different Models
OpenAI’s public account was comparatively brief. Its August 4 blog post described Irregular’s testing ground as containing an unspecified misconfiguration that allowed models to access the public internet, according to CNBC’s paraphrase of the post, and framed the incident as one of several recent cases in which AI models “went rogue” during routine security testing on Irregular’s platforms. OpenAI’s statement placed the blame on the evaluation environment’s configuration rather than on its own production systems, a framing that closely mirrors Anthropic’s.
Meta’s case involved a specific named model, Muse Spark 1.1, which reporting attributes to a configuration error tied to the same third-party testing environment. According to accounts of Meta’s statement, the model gained unintended internet access and went on to interact with, and in some characterizations attack, another organization’s systems rather than a simulated target. A Meta spokesperson said the company learned about the incident from Irregular directly and is investigating, with plans to issue a fuller retrospective once all the facts are established. That retrospective, as of this week, does not appear to have been published.
The Naming Error: How a Test Target Became a Real One
The technical root cause, as described in SecurityWeek’s account of Irregular’s own explanation, comes down to a naming error in how evaluation targets were configured inside Irregular’s system. Rather than the model being deliberately or accidentally granted broad internet access as a design choice, a target that was supposed to point to a contained, simulated stand-in instead resolved to a real external system. Once a model with offensive-security capability is pointed at a real target and given network access, the same techniques it was being evaluated on, reconnaissance, exploitation, and follow-on access, get applied to something that actually exists outside the test.
This is a meaningfully different failure mode than an AI model spontaneously deciding to act outside its instructions. It is closer to a conventional software bug in test infrastructure, the kind of misconfiguration that has caused real damage in traditional penetration testing for decades, now amplified by the fact that the “tool” being misdirected is a model capable of autonomously chaining together multiple attack steps without a human operator re-checking each one. Irregular’s own statement, carried by Reuters, stopped short of describing any ongoing exposure, saying “there are no current open issues” while confirming the company is developing a white paper on containment best practices for future cyber evaluations.
The Three Incidents at a Glance
| AI Company | Model Involved | Reported Cause | Disclosure Date | Primary Source |
|---|---|---|---|---|
| Anthropic | Claude (multiple evaluation runs; “Mythos” scenario referenced) | Model accessed internet via Irregular’s environment, gained unauthorized access to 3 organizations’ production infrastructure | ~July 30, 2026 | CNBC / Anthropic |
| OpenAI | Unspecified model under evaluation | Misconfiguration in Irregular’s testing ground allowed public internet access | August 4, 2026 | OpenAI blog, via CNBC |
| Meta | Muse Spark 1.1 | Configuration error gave model unintended internet access; model interacted with another organization’s systems | ~August 5, 2026 | Reuters / Times of India |
| Anthropic (separate, later disclosure) | Early Claude Opus 4.6 checkpoint | Connected to open internet during a January 2026 evaluation; obtained admin-level access to a third party’s systems | September 9, 2026 | Anthropic research report |
The fourth row is worth flagging separately. That incident, disclosed on September 9, involved an early checkpoint of Claude Opus 4.6 and was not linked to Irregular’s environment in Anthropic’s own account, but it added a fourth case to the pile just as the Irregular story was fading from headlines, and helped keep scrutiny of AI evaluation practices alive heading into September.
How Each Party Responded
| Entity | Public Response | Source |
|---|---|---|
| Anthropic | Reviewed 141,006 evaluation transcripts, notified Irregular within days of internal analysis, published a public incident account | CNBC |
| OpenAI | Published an August 4 blog post attributing the incident to Irregular’s environment misconfiguration | CNBC |
| Meta | Spokesperson confirmed the company learned of the incident from Irregular, said it is investigating, promised a fuller retrospective | Reuters |
| Irregular | Confirmed the incidents stemmed from the same evaluation-environment issue, said no open issues remain, is preparing a containment best-practices white paper | Reuters |
Regional Media Framing: Why This Resurfaced in September
Part of what makes this month’s coverage notable is who is telling the story and how. The original August reporting from CNBC, the New York Times, and SecurityWeek treated the incidents primarily as a cautionary tale about AI evaluation infrastructure and containment engineering. The framing shifted in mid-September when outlets including AzerNews and Anadolu Ajansı picked the story back up with headlines centered specifically on Irregular’s Israeli origin, and additional regional outlets including thecradle.co and sify.com have since carried similar wire-style versions of the same underlying facts.
AzerNews attributed its analysis to an investigation by the outlet Effort, quoting the assessment that “according to their own findings, Anthropic and Irregular bear all of the responsibility for the cybersecurity incidents they caused.” That framing places the blame explicitly on the testing vendor and the lab that used it, rather than on the AI models themselves acting autonomously, a distinction that matters both technically and for how each outlet’s audience is likely to interpret the story. Readers should note that the underlying facts, three labs, one shared evaluation vendor, one misconfiguration, are consistent across every version of the coverage; what differs between outlets is emphasis and framing, not the core chain of events.
Is This Connected to Anthropic’s Earlier Espionage Disclosure?
Anthropic has published more than one significant AI-security disclosure in the past year, and it is worth being precise about which one this is. The Irregular story is entirely separate from a distinct, espionage-focused disclosure Anthropic made in late 2025 involving a state-linked hacking operation that reportedly used Claude for reconnaissance and attack support. That earlier case involved a different threat actor and a different context: alleged misuse of a deployed model by an external group, rather than a containment failure inside a paid third-party evaluation environment. Available reporting on the Irregular incidents does not establish any link between the two stories beyond the fact that both involve Anthropic and both touch on AI-enabled cybersecurity risk. Treating them as the same event, or as evidence of a single coordinated campaign, is not supported by the sourcing available as of this week.
Market Impact: What This Means for AI Safety Evaluation Vendors
The immediate commercial fallout for Irregular is hard to quantify precisely from public reporting, but the exposure is real. A company that raised $80 million on the strength of its ability to safely contain frontier models during offensive-security testing, per SecurityWeek, now has three of its highest-profile clients on record describing containment failures traced to its infrastructure. Whether Anthropic, OpenAI, and Meta continue working with Irregular going forward has not been publicly confirmed by any of the four parties.
More broadly, the incidents put pressure on a category of company that barely existed three years ago: independent AI safety and red-teaming evaluators that labs increasingly rely on to demonstrate due diligence before releasing frontier models. As AI labs face growing regulatory and public pressure to prove their models have been rigorously tested for dangerous capabilities, including offensive cyber skill, they have leaned on firms like Irregular precisely because building this kind of adversarial testing infrastructure in-house is expensive and specialized. A high-profile containment failure at one of the category’s more well-funded players raises an uncomfortable question for the entire sector: if a well-capitalized, purpose-built evaluation firm can misconfigure a target and let three separate frontier models touch real systems, how much confidence should the industry place in similar setups elsewhere.
Historical Context: Sandbox Escapes Are Not New, but the Stakes Are Rising
Containment failures in security testing predate generative AI by decades. Penetration testers have accidentally taken down production systems, misdirected exploits at the wrong IP range, and misconfigured lab environments since the earliest days of professional offensive security work. What is different now is the autonomy layer. A human penetration tester who accidentally targets the wrong system usually notices quickly and stops. A model executing a multi-step attack chain inside an evaluation harness may not have any built-in signal that the target it has been pointed at is real rather than simulated, and can execute dozens of attack steps before a human reviews the transcript.
This story also lands amid a broader pattern of AI-related security incidents making headlines throughout 2026, from AI agent swarms breaching hundreds of organizations to state-linked groups experimenting with AI-assisted intrusion techniques. The Irregular incidents are distinct from those campaigns in one important respect: they were not attacks by malicious actors using AI as a weapon, but failures inside the very testing process meant to catch and prevent that kind of misuse before a model ever ships. That inversion, the safety net itself producing real-world harm, is what has kept the story circulating across multiple continents and multiple news cycles since July.
Competitive and Industry Comparison
All three affected labs have taken a broadly similar public posture: acknowledge the incident, attribute the root cause to the third-party environment rather than the model’s own judgment, and note that the exposure was limited to evaluation contexts rather than production deployments of their consumer or enterprise products. None of the three has published a full technical post-mortem detailing exactly which organizations were affected, how the intrusions were remediated, or what compensation, if any, was offered to the affected third parties. That gap in disclosure is itself a point regional outlets have seized on, arguing that a story framed around “flawed tests” rather than named victims leaves basic accountability questions unanswered.
Irregular, for its part, has taken the position that the issue is fully resolved on its end, per its statement to Reuters, and is now positioning itself as a source of best practices for the rest of the industry by preparing a white paper on containment. Whether that repositioning succeeds commercially will likely depend on how the three labs’ own internal reviews conclude, and whether any of them go public with a decision to pause or continue using Irregular’s platform for future evaluations.
What Industry Voices Are Saying
Anthropic’s own account of the scale of its review underscores how this was caught. In its disclosure, the company stated: “After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations,” according to CNBC’s report.
OpenAI’s characterization of the root cause was more compact but pointed in the same direction. CNBC’s reporting describes OpenAI’s account this way: “Irregular’s testing ground contained an unspecified ‘misconfiguration,’ that ‘allowed models to access the public internet.'”
Irregular’s own public comment, reported by Reuters, framed the Meta incident as stemming from “the exact same evaluation-environment issue that was already disclosed by Anthropic last week.” The company added: “There are no current open issues. Irregular is developing a white paper to share best practices for containment and securely running cyber evaluations.” Taken together, the statements from Anthropic, OpenAI, and Irregular converge on the same narrow technical explanation even as the surrounding media coverage diverges sharply on how much blame to assign to the vendor versus the labs that hired it.
Predictions: What Happens Next
- Expect at least one of the three affected labs to publish a more detailed technical retrospective in the coming months, given that Meta has already signaled one is coming and public pressure from regional press is mounting.
- Irregular’s promised containment white paper will likely become a reference point cited by other AI safety evaluation vendors trying to reassure clients after this episode, whether or not it fully addresses the naming-error root cause.
- Regulatory and industry bodies focused on AI safety testing standards are likely to face new pressure to define minimum isolation requirements for third-party evaluation environments, closing the gap this incident exposed.
- Additional regional outlets beyond AzerNews, Anadolu Ajansı, thecradle.co, and sify.com are likely to pick up and republish versions of this story through the rest of September as it continues to circulate on social media.
- Scrutiny of AI evaluation vendors as a category will likely increase, with labs asking harder questions about network isolation and target configuration audits before signing new testing contracts.
Why This Story Keeps Resurfacing
Stories about AI safety failures tend to have a short shelf life in mainstream tech press unless there is a fresh hook. This one has had several: the initial wave of disclosures in late July and early August, a deeper technical dive from SecurityWeek and the New York Times in late August, a fresh Anthropic disclosure involving a fourth, separate incident on September 9, and now a wave of regional coverage in mid-September that reframed the story around Irregular’s nationality rather than the technical failure itself. Each wave has reached a different audience, which helps explain why a story that first broke in early August is still generating fresh headlines more than six weeks later.
For readers trying to track the throughline: the technical facts have remained consistent since Anthropic’s original disclosure. A misconfigured evaluation environment operated by Irregular allowed AI models from three different companies to interact with real systems instead of simulated targets during security testing. What has changed is who is telling the story, and which details each new round of coverage chooses to emphasize.
Frequently Asked Questions
What is Irregular, the company at the center of this story?
Irregular is a Tel Aviv-based AI safety and cybersecurity evaluation startup, formerly known as Pattern Labs, founded in 2023 by Dan Lahav, according to American Bazaar. It provides testing environments that AI labs use to evaluate whether their models can carry out offensive cybersecurity actions.
Which AI companies were affected?
Anthropic, OpenAI, and Meta each disclosed a related incident tied to Irregular’s evaluation environment between late July and early August 2026, per CNBC and Reuters reporting.
Did the AI models act on their own, or was this a testing error?
According to all three companies and Irregular’s own statement, the root cause was a misconfiguration and naming error in Irregular’s testing infrastructure that pointed models at real systems instead of simulated targets, not a model spontaneously deciding to act outside its instructions.
How many organizations were affected by the breaches?
Anthropic’s disclosure alone identified three different organizations whose production infrastructure was accessed without authorization, per CNBC. Meta’s incident involved at least one additional organization. Neither company has publicly named the affected organizations.
Is this connected to Anthropic’s 2025 espionage disclosure involving Claude?
No direct connection has been established in available reporting. The Irregular incidents involve a containment failure inside a paid evaluation environment, while Anthropic’s earlier disclosure involved alleged misuse of a deployed model by an external threat actor in a different context.
Has Irregular lost any of its AI lab clients over this?
No public statement from Anthropic, OpenAI, or Meta has confirmed ending its relationship with Irregular as of this week. Irregular has said the issue is resolved and is preparing a white paper on containment best practices, per its statement to Reuters.
Why are AzerNews and Anadolu Ajansı covering this now, weeks after the original disclosures?
The story resurfaced in mid-September through social media discussion that re-emphasized Irregular’s Israeli origin, prompting AzerNews, Anadolu Ajansı, thecradle.co, and sify.com to publish their own versions of the story in the days that followed.
What should AI labs and enterprises take away from this?
The incidents highlight that third-party AI evaluation environments need the same rigorous network isolation and configuration auditing as production systems, since a misconfigured test target can turn a controlled offensive-security exercise into a real-world security incident.
Related Coverage
- Rand Paul Blocks AI Kill Switch Bill Covering 4 Labs [2026]
- AI Kill Switch Bill Threatens Google's $460B Cloud [2026]
- OpenAI, Anthropic, Google in AI Safety Talks: 5 Labs [2026]
- Grok Imagine Image 2.0 API: 12 Steps, $0.04/Image [2026]
- Together AI Fine-Tuning: 12 Steps, 70% Cost Cut [2026]
