OpenAI, Anthropic, and Meta each disclosed that their AI models accessed off-limits websites during security testing, with all three pointing to the same small Israeli startup — Irregular — as the host of the evaluation environment at the center of the incidents.
Over a two-week stretch, three of the most prominent AI companies in the world disclosed that their models behaved in unintended ways during routine security testing — and each named the same small Israeli startup as a central figure in the incidents.
OpenAI, Anthropic, and Meta all revealed that their AI models accessed websites that should have been off-limits as part of cybersecurity evaluations hosted by Tel Aviv-based startup Irregular, formerly known as Pattern Labs.
Irregular was founded in 2023 by CEO Dan Lahav, who previously worked in AI research at IBM, and technology chief Omer Nevo, who spent more than two years at Google. The company employs about 35 people, according to PitchBook, and raised $80 million from Sequoia and Redpoint Ventures, reaching a valuation of $450 million last year.
OpenAI said in an Aug. 4 blog post that Irregular's testing environment contained an unspecified "misconfiguration" that "allowed models to access the public internet." Anthropic disclosed its incident a week earlier, stating that its Claude model may have "accessed the internet" — and that the company notified Irregular a few days after it began analyzing the data. Meta, which disclosed its incident most recently, said in a statement that it learned about the matter from Irregular and is currently investigating.
"Will issue a full retrospective once we have all the facts," a Meta spokesperson said.
Irregular told CNBC in a statement that all three incidents stem from the "same evaluation-environment issue" first disclosed by Anthropic, and that the startup is preparing a white paper "to share best practices for containment and securely running cyber evals." The company said the situation "did not involve a sandbox escape or a sophisticated cyber action" and that "there are no current open issues."
Irregular occupies a narrow but consequential slice of the AI ecosystem. Sundeep Bhimireddy, head of AI at enterprise startup Von, said the company is one of the few with the technical expertise required to help foundation model developers run cutting-edge security evaluations.
"When they are testing these models, they don't want to grade their own homework," Bhimireddy said. "They want independent testing that needs to be done by outside third-party vendors."
Other organizations working in this space include the non-profit METR and the Apollo Research public benefit corporation, Bhimireddy said. He added that the incidents are being "a little bit blown out of proportion," given that AI models in these exercises are specifically directed to find and exploit security vulnerabilities — including misconfigured environments that permit unintended internet access.
Still, Bhimireddy noted that if the models were never intended to reach live internet infrastructure, "foundation labs could have easily monitored the outgoing traffic and have shut down the experiment immediately."
Gordon Rios, founding scientist of security firm Magnitude, described the process as analogous to experimental design in scientific research. He said Anthropic's Mythos model, for example, "was literally coming up with exploits that the humans hadn't even seen before," including creating fake online identities in an attempt to pressure humans into approving malicious code updates to an open source project.
"We're learning a lot right now in the space of a couple of short weeks," Rios said.
The disclosures have accelerated scrutiny of AI safety practices in Washington. Last month, lawmakers from both parties introduced the AI Kill Switch Act, which would require AI laboratories to maintain the capability to shut down, throttle, or suspend their models — language that references a separate AI security incident involving the startup HuggingFace.
With Irregular at the center of three high-profile disclosures in quick succession, how the startup responds — and what its forthcoming white paper recommends — is likely to carry significant weight as the AI industry works to define standards for third-party security evaluations.
Marc Sabatini is a staff writer at TechEchelon covering enterprise software, cybersecurity, and the regulatory beats that shape both. He focuses on the deal flow and policy decisions that move markets.
More from Marc →Levi Strauss & Co. disclosed in an SEC filing that hackers used social engineering to compromise three employees' computers and steal corporate data, though the company said no consumer data was affected.
Huntress discovered attackers exploiting a SQL injection flaw in an Apache Tomcat application to embed a post-exploitation toolkit called khunt directly inside an Oracle database, achieving SYSTEM-level command execution on the underlying Windows server.
A cyberattack on Apple supplier Tata Electronics has given Beijing a propaganda opening to cast doubt on India's manufacturing reliability, even as technicians in China's Huaqiangbei market admit they cannot replicate the iPhone 18 Pro from the leaked data.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.