Israeli AI evaluator Irregular's flawed cybersecurity testing environment let agents from OpenAI, Anthropic, Meta and Google reach real-world targets outside the intended simulation

Irregular, an AI red-teaming vendor, says a single flawed test setup, unintended open internet access combined with a fictional test-company name that happened to match a real domain, caused cybersecurity-capability tests to spill outside the intended sandbox. Irregular's CTO Omer Nevo attributes several previously reported "rogue AI" incidents involving OpenAI, Anthropic, Meta and Google agents to this one root cause, and says the affected companies were notified in late July 2026. Irregular says it has since tightened internet access controls and added monitoring, but has not published an incident report or technical postmortem. Testing of two Chinese open-weight models reportedly did not show the same issue, per Irregular.

This reframes a string of alarming "AI agents going rogue" stories as a vendor's testing-environment misconfiguration rather than emergent misbehaviour by the models themselves, which matters for how enterprises and regulators interpret those earlier incidents. It is a live reminder that AI capability evaluations, including ones run by frontier labs' own contracted red-teamers, can leak into production systems if sandbox isolation is weak, which is directly relevant to anyone commissioning or relying on third-party model evaluations. The practical impact is mostly on evaluation methodology and vendor due diligence, not on any new model capability or deployed product.

This is secondary reporting: no incident report, root-cause postmortem or regulatory filing is linked, so the "single flawed environment tied everything together" claim rests entirely on one on-record vendor quote. Irregular's remediation claims ("tightened controls," "expanded monitoring") are unverified self-description from the company whose failure caused the problem, and the "wave of rogue AI attacks" framing overstates novelty since the individual incidents were already public; what's new here is the alleged common cause, not the events themselves.

1. 01Whether Irregular, OpenAI, Anthropic, Meta or Google publish a technical incident report or postmortem confirming the root cause and remediation
2. 02Whether any regulator (UK AI Security Institute, RAND, or others named) opens a review of third-party AI evaluation practices as a result
3. 03Whether further 'rogue AI' incidents recur after Irregular's claimed fixes, which would undermine the remediation claim