{"id":7658,"date":"2026-09-25T15:50:35","date_gmt":"2026-09-25T15:50:35","guid":{"rendered":"https:\/\/silvybrand.com\/?p=7658"},"modified":"2026-09-25T15:50:35","modified_gmt":"2026-09-25T15:50:35","slug":"irregular-rogue-ai-cyberattacks-hacking-openai-meta-anthropic-google","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=7658","title":{"rendered":"One company is at the center of a wave of rogue AI attacks"},"content":{"rendered":"


\n<\/p>\n

\n
\n

In July, OpenAI revealed that its AI agents had attacked Hugging Face without permission<\/a>, sparking widespread concerns about AI safety.<\/a> Since then, a string of similar incidents<\/a> involving agents from Meta, Anthropic, Google, and other companies has fueled further fears about rogue AI<\/a>. As disclosures implicating numerous AI models trickled out over the past few months, these seemed like separate incidents. But many share a common source: one specific company tasked with testing the agents.<\/p>\n<\/div>\n

\n

Irregular<\/a>, an Israeli startup that stress-tests AI models in \u201chigh-fidelity research platforms that simulate and monitor real-world AI security scenarios,\u201d has worked with many of the industry\u2019s biggest players since it was founded as Pattern Labs in 2023. Its exact client list is not known, but its work has been cited in OpenAI model system cards<\/a>, it was used to test systems<\/a> for the UK government and Anthropic, and it published<\/a> research with RAND, a highly influential think tank that informs policy on AI.<\/p>\n<\/div>\n

\n

In several Irregular tests this year, agents escaped their supposedly secure testing environments and went after real-world targets.<\/p>\n<\/div>\n

\n

The breaches, which are independent of the Hugging Face hack, all follow the same broad template: Irregular was testing the models\u2019 cybersecurity capabilities in controlled environments meant to simulate realistic conditions. Some of the tests used \u201ccapture-the-flag\u201d exercises, a common way of testing hacking abilities that asks agents to find hidden information inside of a simulated network. At least, the network is meant to be simulated.<\/p>\n<\/div>\n

\n

Irregular CTO and cofounder Omer Nevo told The Verge<\/em> that the agents were not supposed to have access to the open internet, but that \u201cinternet access was unintentionally available.\u201d At the same time, Nevo said a fictional company name created for the simulation as a target \u201coverlapped with a real domain.\u201d Put together, those mistakes sent the agents after real-world targets, though it\u2019s not clear which companies or organizations were actually attacked.<\/p>\n<\/div>\n

\n
\n

\u201cAll the incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario and have been disclosed.\u201d<\/p>\n<\/div>\n<\/div>\n

\n

Nevo confirmed to The Verge <\/em>that this same issue was behind incidents involving models from OpenAI<\/a>, Meta<\/a>, Anthropic<\/a>, and Google<\/a>. \u201cAll the incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario and have been disclosed,\u201d he said. \u201cOther security incidents which have been reported recently across the industry are unrelated to Irregular or to our evaluations.\u201d This includes the Hugging Face hack and breaches from the UK\u2019s AI Security Institute<\/a>.<\/p>\n<\/div>\n

\n

\u201cDisclosed\u201d does not necessarily mean made public, though, and it\u2019s unclear whether Nevo was referring to informing Irregular\u2019s clients, the public, or someone else. While the incidents all stemmed from the same underlying testing failure, reports from Anthropic<\/a> and OpenAI<\/a>, along with reporting<\/a> on Google, indicate the tech companies were notified at roughly similar times in late July. OpenAI and Anthropic announced the breaches themselves, while the incidents involving Meta and, weeks later, Google first became public through media reports.<\/p>\n<\/div>\n

\n

Irregular\u2019s cybersecurity testing goes beyond the four US tech giants. Research published on its website indicates it has also conducted<\/a> similar<\/a> cybersecurity testing on Kimi K3 and GLM-5.2, open AI models<\/a> from Chinese companies<\/a> Moonshot AI and Z.ai, respectively. Unlike the proprietary models involved in the other incidents \u2014 Meta has kept its flagship Spark model proprietary \u2014 these models can be freely downloaded and run on users\u2019 own hardware, meaning testers like Irregular don\u2019t have to rely on the companies for access or send data back to them. Irregular\u2019s research describes them as \u201cself-hosted\u201d instances.<\/p>\n<\/div>\n

\n
\n

\u201cDisclosed\u201d does not necessarily mean made public.<\/p>\n<\/div>\n<\/div>\n

\n

The evaluations of the Chinese models did not result in similar real-world incidents, Nevo said: \u201cWe did not observe the same type of issue described in the incidents referenced here during our evaluations of GLM or Kimi.\u201d However, Nevo cautioned that this \u201cobservation alone should not be interpreted as evidence that these models are less susceptible to this kind of behavior.\u201d Neither Moonshot nor Z.ai responded to The Verge<\/em>\u2019s request for comment.<\/p>\n<\/div>\n

\n

Nevo said the incidents have prompted changes at Irregular. \u201cWe have tightened internet access controls, expanded monitoring and manual review, and strengthened checks before evaluations begin to verify that access matches the intended scope,\u201d he said. \u201cWe have also improved how we document and agree on each evaluation\u2019s setup and parameters with our partners.\u201d<\/p>\n<\/div>\n

\n

Irregular also plans to publish a broader report \u201ccovering lessons learned and practices for conducting cyber evaluations safely\u201d once that joint work with the companies involved is complete, Nevo said. \u201cOur work with partners aims to turn lessons from these incidents into public shared practices for developing and evaluating increasingly powerful AI safely.\u201d<\/p>\n<\/div>\n

\n
\n
\n

Are you an AI safety researcher or frontier lab employee?<\/h2>\n<\/p>\n<\/div>\n
\n

You can contact me securely and confidentially via Signal at robhart.01<\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n

Nevo said Irregular has addressed the issues with the testing environment that were linked to the incidents. None of the four US AI companies answered questions asking for further details \u2014 including when they became aware of the breaches, whether they were seeking damages or other remedies from Irregular, and whether they expected to continue working with the Irregular. Google and Anthropic did not respond, while OpenAI and Meta pointed The Verge<\/em> to previously<\/a> published<\/a> blog posts.<\/p>\n<\/div>\n

Follow topics and authors<\/strong> from this story to see more like this in your personalized homepage feed and to receive email updates.<\/span><\/p>\n