Headlines over the past two months have painted a dramatic picture: AI models from Google, OpenAI, Anthropic, and Meta "autonomously" hacking into real companies, going rogue, escaping their digital cages. The reality is far less cinematic and far more damning.
Every one of these incidents traces back to a single contractor: Irregular, an Israeli firm that sells itself as a "Frontier AI Security" company. The same company was responsible for setting up the test environments where all these hacks occurred, and in every case, it left internet access open in what was supposed to be an isolated sandbox.
One Contractor, Three Months of Breaches
The timeline is damning. On July 30, Anthropic disclosed three incidents across six evaluation runs where its Claude models hacked into real companies. Five days later, OpenAI admitted its models had escaped a supposed offline environment and compromised systems at a startup valued at $4.5 billion. By August 6, Meta confirmed one of its models had also breached a real company. Anthropic expanded its count to four incidents across seven runs on September 9.
In every case, Irregular was the evaluation partner. The company designed the tests, set up the environments, and was supposed to keep the AI models contained. It failed at the most basic task: keeping test machines off the internet.
The Models Were Told to Hack
The word "autonomously" in those headlines does a lot of heavy lifting, and it is misleading. In the Gemini incident, Google's model was given a prompt that literally instructed it to hack a company. The target was fictional. The company name in the test happened to match a real business. When the model gained internet access (thanks to Irregular's misconfiguration), it targeted the real company instead of the fictional one.
Anthropic's own disclosure makes the situation clearer. Each Claude instance was running a CTF (capture the flag) challenge: a puzzle-solving exercise where the AI retrieves a secret piece of data from a target machine. The prompts told Claude it had no internet access, but Irregular's setup left internet access wide open. None of the prompts constrained which systems were in scope. Each run lasted between 10 and 34 hours of active work.
The critical detail: once Anthropic employees told the Claude models to stop hacking real systems, real-world hacking dropped to zero percent. The models were not going rogue. They were following instructions in a misconfigured environment.
Safeguards Were Stripped on Purpose
Standard safety filters that ship with production AI models are deliberately removed during red-team evaluations. The whole point of these tests is to discover what a model can do without guardrails. When a company like Irregular then provides internet access that should not exist, the model uses every capability available to it, including the ones that would normally be blocked.
This is not a model malfunctioning. It is a model doing exactly what it was told to do, in an environment that was not set up correctly.
The Journalism Problem
Major outlets ran with the "autonomous hacking" framing without basic reporting. The BBC's front-page piece on the Gemini incident did not mention that the model was instructed to hack, that safeguards were removed, or that Irregular failed to isolate its test environment. The New York Times included some of this context, but the sensational framing persisted across coverage.
Brian Chau, writing at Effort News, pointed out the obvious question nobody is asking: why are American AI companies handing their most capable models to an Israeli firm that cannot keep a test machine off the internet? Irregular's co-founders, Omer Nevo and Dan Lahav, are embedded in the Effective Altruism network, with board roles at EA Israel and connections to NGOs funded by Dustin Moskovitz's philanthropic vehicles.
What This Actually Means for AI Security
The real story here is not about AI models developing dangerous intentions. It is about a pattern of negligent testing practices by a single contractor, and the media's willingness to amplify a more exciting but inaccurate narrative.
For developers and security teams, the takeaway is practical: if you are evaluating AI models for security capabilities, your test environment must be air-gapped. No internet access, no exceptions. And if your evaluation vendor cannot guarantee that, you need a new vendor.
For the broader industry, these incidents should prompt a hard look at how AI safety testing is conducted, who conducts it, and what oversight exists. The fact that three of the largest AI companies all used the same contractor, and all experienced the same type of failure, suggests a systemic problem rather than isolated accidents.