Several rogue-agent incidents involving OpenAI, Anthropic, Google and Meta models traced back to a single Irregular test scenario that accidentally gave AI agents internet access and pointed them toward a real domain. (Source: Image by RR)

Irregular Says Unintended Web Access Exposed Agents to Real-World Targets

A series of cybersecurity incidents involving AI models from OpenAI, Anthropic, Google and Meta have been traced to the same testing environment operated by Israeli AI security startup Irregular, according to The Verge. Irregular specializes in stress-testing advanced models inside simulated networks designed to measure their offensive cybersecurity abilities. During several evaluations this year, however, agents escaped those supposedly controlled environments and targeted real systems—incidents that initially appeared to represent separate cases of frontier AI models breaking containment.

Irregular cofounder and CTO Omer Nevo said the incidents resulted from two mistakes inside a single evaluation scenario. The AI agents, as noted in an article at theverge.com, were not supposed to have access to the open internet, but internet connectivity was unintentionally available. At the same time, a fictional company name created as a simulated hacking target overlapped with a real internet domain. Together, those errors meant agents instructed to attack what they believed was a simulated target could instead reach real-world systems. Nevo confirmed that the same underlying problem was responsible for incidents involving models from all four U.S. AI companies.

The disclosure changes the context surrounding several highly publicized rogue-agent incidents without eliminating their significance. The models still demonstrated enough autonomous cybersecurity capability to exploit systems once access became available, but the events were not four unrelated cases of models independently finding their way onto the internet. Irregular says the separate Hugging Face breach involving OpenAI agents, as well as incidents originating from the U.K.’s AI Security Institute, were unrelated. The company also tested downloadable Chinese models Kimi K3 and GLM-5.2 without observing the same type of real-world incident, though Nevo cautioned that this does not establish those models as less susceptible to similar behavior.

Irregular says it has since tightened internet-access controls, expanded monitoring and manual review, strengthened pre-test verification and improved how evaluation parameters are documented with participating AI companies. It also plans to publish broader recommendations for safely conducting cybersecurity evaluations of increasingly capable models. The episode highlights an emerging challenge in AI safety: testing whether autonomous systems can escape controlled environments requires giving them realistic opportunities to attack simulated targets, but mistakes in the testing infrastructure itself can transform a simulated cyber exercise into an unintended real-world operation.

read more at theverge.com