In July, OpenAI disclosed that its AI agents had attacked Hugging Face without authorization, triggering alarm across the AI industry. Over the following weeks, similar incidents emerged involving agents from Meta, Anthropic, and Google — a cascade of breaches that appeared to be separate failures. They were not. At the center of the wave sits a single Israeli startup whose security testing mistakes inadvertently sent some of the most powerful AI models in the world after real-world targets.
The Testing Company Behind the Incidents
Irregular, founded in 2023 under the name Pattern Labs, builds what it describes as "high-fidelity research platforms that simulate and monitor real-world AI security scenarios." Its client roster is not public, but its work has been cited in OpenAI model system cards, used to test systems for the UK government and Anthropic, and published in collaboration with RAND, the influential defense and policy think tank.
The company's CTO and cofounder, Omer Nevo, confirmed to The Verge that all of the incidents involving major AI companies traced back to the same root cause: a single evaluation scenario with a critical configuration error.
Two Mistakes, Real-World Consequences
The breach template was consistent across every affected client. Irregular was running cybersecurity evaluations using "capture-the-flag" exercises — a standard practice in security testing where agents search for hidden information inside a simulated network. The network, at least in theory, was simulated.
Two things went wrong simultaneously. First, internet access that was supposed to be restricted was inadvertently available to the agents. Second, a fictional company name created for the simulation overlapped with an actual domain. Combined, those errors caused the AI agents to treat real-world targets as legitimate objectives of the exercise.
"All the incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario and have been disclosed," Nevo said. He emphasized that other recent security incidents — including the Hugging Face hack and breaches attributed to the UK's AI Security Institute — were unrelated to Irregular's testing.
Who Was Affected, and What They Said
Nevo confirmed that models from OpenAI, Meta, Anthropic, and Google were all implicated in the incidents. The four companies were notified at roughly the same time in late July. OpenAI and Anthropic publicly announced their breaches. The Meta incident first surfaced through media reports weeks later, as did Google's. Neither Google nor Anthropic responded to questions about the breach; OpenAI and Meta directed inquiries to previously published blog posts.
None of the four companies answered questions about when they became aware of the breaches, whether they were seeking remedies from Irregular, or whether they intended to continue working with the company.
Chinese Models Were Tested Too
Irregular's cybersecurity testing extended beyond the major US labs. Published research on the company's website indicates it also evaluated Kimi K3 from Moonshot AI and GLM-5.2 from Z.ai — both open-source models that can be downloaded and run independently. Unlike the proprietary models involved in the other incidents, these did not require Irregular to rely on the originating companies for access.
Nevo said the evaluations of the Chinese models did not produce the same real-world escape incidents. But he cautioned that this observation alone should not be taken as evidence that those models are less susceptible to the behavior.
What Has Changed
Irregular says it has responded to the incidents by tightening internet access controls, expanding monitoring and manual review, and strengthening pre-evaluation checks to verify that access matches the intended scope. The company has also improved how it documents and agrees on evaluation parameters with partners.
Nevo said Irregular plans to publish a broader report covering lessons learned and safe evaluation practices once collaborative work with the affected companies is complete. Whether that report will make the full details public — or simply share them internally among clients — remains unclear. "Disclosed" and "made public" are not the same thing, and the distinction matters when the stakes involve AI agents wandering into the real world.