Irregular AI Agent Cyberattacks Trace to a Test Setup Failure

Several incidents involving AI agents from OpenAI, Meta, Anthropic and Google traced back to one security evaluation scenario run by Israeli startup Irregular. The agents were meant to work in controlled simulations, but Irregular’s CTO said internet access was unintentionally available, while a fictional company used as a target overlapped with a real domain. Together, those mistakes sent agents after real-world targets.

The incidents were independent of the earlier Hugging Face hack involving OpenAI agents. The Verge reported that it remains unclear which real-world organizations were actually targeted, and Irregular’s exact client list is not known.

A simulated network, with a route out

Irregular stress-tests AI models in research platforms designed to simulate and monitor real-world security scenarios. Some evaluations use capture-the-flag exercises, where an agent searches a simulated network for hidden information. That setup only works as a contained test if the boundaries hold.

Here, two details mattered: the agents could reach the open internet, and the fictional target name matched a real domain. Neither detail alone explains the whole chain. Together, they meant an agent following the exercise could interact with a real system rather than only the simulated one.

That makes this more than a story about a model behaving unexpectedly. The agents were performing cybersecurity tasks in an evaluation, but the environment did not enforce the intended scope. A test can therefore expose outside systems even when its target and purpose are fictional.

What the incidents do, and do not, establish

Irregular’s CTO said the incidents involving the four labs came from the same underlying issue in one evaluation scenario. The Verge reported that OpenAI and Anthropic announced incidents themselves, while reports involving Meta and Google first became public through media coverage. Irregular’s statement that incidents were “disclosed” does not clarify whether that meant public disclosure or notification to particular parties.

Irregular said it tightened internet-access controls, expanded monitoring and manual review, strengthened checks before evaluations, and improved documentation of test setups with partners. Those changes address the reported failure’s mechanics: restrict access, verify scope, and add review around the test environment.

Irregular also evaluated self-hosted versions of Kimi K3 and GLM-5.2 without observing the same type of issue. But its CTO cautioned that this observation is not evidence those models are less susceptible. A test without a reported incident is not a comparative safety result.

The practical distinction is between an agent’s actions and the system that gives those actions reach. When evaluation environments can access real domains, containment is part of the security test itself, not just infrastructure around it.