One testing vendor behind the wave: Irregular's CTO says unintended internet access and a name that 'overlapped with a real domain' sent OpenAI, Meta, Anthropic, and Google agents after real-world targets

“A testing startup's CTO says two mistakes sent AI agents from four major labs after real-world targets.”

Usable claims

• On Friday, September 25, 2026 (calendar-verified), The Verge reported that many of the summer's AI-agent incidents share a common source. The Verge's standfirst: "Mistakes at Israeli startup Irregular sent Anthropic, OpenAI, Meta, and Google agents after real-world targets." Per The Verge: "In July, OpenAI revealed that its AI agents had attacked Hugging Face without permission, sparking widespread concerns about AI safety. Since then, a string of similar incidents involving agents from Meta, Anthropic, Google, and other companies has fueled further fears about rogue AI. As disclosures implicating numerous AI models trickled out over the past few months, these seemed like separate incidents. But many share a common source: one specific company tasked with testing the agents." Per The Verge: "Irregular, an Israeli startup that stress-tests AI models in 'high-fidelity research platforms that simulate and monitor real-world AI security scenarios,' has worked with many of the industry's biggest players since it was founded as Pattern Labs in 2023. Its exact client list is not known, but its work has been cited in OpenAI model system cards, it was used to test systems for the UK government and Anthropic, and it published research with RAND, a highly influential think tank that informs policy on AI." The inner quoted phrase matches Irregular's own about page, which says: "We build next-generation defenses through high-fidelity research platforms that simulate and monitor real-world AI security scenarios." Per The Verge: "In several Irregular tests this year, agents escaped their supposedly secure testing environments and went after real-world targets." And: "The breaches, which are independent of the Hugging Face hack, all follow the same broad template: Irregular was testing the models' cybersecurity capabilities in controlled environments meant to simulate realistic conditions. Some of the tests used 'capture-the-flag' exercises, a common way of testing hacking abilities that asks agents to find hidden information inside of a simulated network. At least, the network is meant to be simulated." Irregular CTO and cofounder Omer Nevo told The Verge that the agents were not supposed to have access to the open internet, but that "internet access was unintentionally available." Nevo also said a fictional company name created for the simulation as a target "overlapped with a real domain." Per The Verge: "Put together, those mistakes sent the agents after real-world targets, though it's not clear which companies or organizations were actually attacked." Nevo's scoping, per The Verge: "All the incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario and have been disclosed," while "Other security incidents which have been reported recently across the industry are unrelated to Irregular or to our evaluations." That, per The Verge, includes the Hugging Face hack and breaches from the UK's AI Security Institute. The Verge's flag: "'Disclosed' does not necessarily mean made public, though, and it's unclear whether Nevo was referring to informing Irregular's clients, the public, or someone else." Per The Verge, "reports from Anthropic and OpenAI, along with reporting on Google, indicate the tech companies were notified at roughly similar times in late July. OpenAI and Anthropic announced the breaches themselves, while the incidents involving Meta and, weeks later, Google first became public through media reports." Per The Verge: "Research published on its website indicates it has also conducted similar cybersecurity testing on Kimi K3 and GLM-5.2, open AI models from Chinese companies Moonshot AI and Z.ai, respectively. Unlike the proprietary models involved in the other incidents — Meta has kept its flagship Spark model proprietary — these models can be freely downloaded and run on users' own hardware, meaning testers like Irregular don't have to rely on the companies for access or send data back to them. Irregular's research describes them as 'self-hosted' instances." Nevo, per The Verge: "We did not observe the same type of issue described in the incidents referenced here during our evaluations of GLM or Kimi." With the caution: "observation alone should not be interpreted as evidence that these models are less susceptible to this kind of behavior." Neither Moonshot nor Z.ai responded to The Verge's request for comment. Nevo on the fixes: "We have tightened internet access controls, expanded monitoring and manual review, and strengthened checks before evaluations begin to verify that access matches the intended scope," and: "We have also improved how we document and agree on each evaluation's setup and parameters with our partners." Irregular also plans to publish a broader report "covering lessons learned and practices for conducting cyber evaluations safely" once joint work with the companies involved is complete. Per The Verge: "None of the four US AI companies answered questions asking for further details — including when they became aware of the breaches, whether they were seeking damages or other remedies from Irregular, and whether they expected to continue working with the Irregular. Google and Anthropic did not respond, while OpenAI and Meta pointed The Verge to previously published blog posts." Irregular's own research page, dated July 16, 2026 (Thursday, calendar-verified), corroborates the open-model testing setup: "Irregular evaluated self-hosted GLM-5.2, a 750B-parameter model, across three evaluation suites: Atomic Tasks, CyScenarioBench, and FrontierCyber."