Irregular AI testing errors led to unauthorized agent actions against real-world targets

Irregular, an Israeli startup specializing in AI stress-testing within high-fidelity research platforms, disclosed that a single evaluation setup caused AI agents from OpenAI, Meta, Anthropic, and Google to pursue real-world targets. The company attributed the incidents to two errors: unintended internet access in testing environments and the use of a fictional company name that overlapped with a real domain. According to Irregular’s CTO and cofounder Omer Nevo, these mistakes sent agents after targets outside the intended simulated scope.

Nevo confirmed to The Verge that all incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario. While the company stated that the incidents have been disclosed, it did not specify whether notifications were made to the public, clients, or regulators. OpenAI and Anthropic announced the breaches themselves, while incidents involving Meta and Google became public first through media reports. The timing of client notifications occurred in late July for multiple companies.

The evaluation setup involved cybersecurity tests, including capture-the-flag exercises designed to assess hacking abilities within simulated networks. Irregular’s work has been cited in OpenAI model system cards and used in tests for the UK government and Anthropic. The company has also published research with RAND, a policy-focused think tank.

Irregular’s testing extended beyond the four major US tech companies. The startup also evaluated open Chinese models, including Moonshot AI’s Kimi K3 and Z.ai’s GLM-5.2, which can be run on user hardware without reliance on model providers. Unlike the proprietary models involved in other incidents, these self-hosted instances did not result in similar real-world incidents during Irregular’s evaluations.