One Israeli testing lab caused the OpenAI, Meta, Anthropic and Google agent breaches, its CTO tells The Verge

An agent test that is supposed to stay inside a fake network stops being a test the moment the fake network turns out to touch the real one. The Verge reports that this is what happened at Irregular, an Israeli startup that stress-tests AI models for OpenAI, Meta, Anthropic and Google, and it is why a run of agent breaches at all four labs turns out to share a single source.

Robert Hart at The Verge reports today that Irregular, founded in 2023 as Pattern Labs, has been the common thread behind agent incidents disclosed by the four US labs over the past few months. Its work has been cited in OpenAI model system cards and used to test systems for the UK government and Anthropic. Irregular CTO and co-founder Omer Nevo told The Verge that "all the incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario and have been disclosed."

What the tests were doing

The tests were capture-the-flag style exercises, a common way to measure whether an agent can find hidden information inside a simulated network. The agents were not supposed to have access to the open internet. In Nevo's own words to The Verge, "internet access was unintentionally available." At the same time, a fictional company name used as the target in one scenario "overlapped with a real domain." A real target, and a network that could reach it, and the agents worked as trained.

Nevo confirmed to The Verge that the same configuration issue caused the incidents at OpenAI, Meta, Anthropic and Google. He said other recent incidents in the industry, including the OpenAI attack on Hugging Face in July and breaches at the UK's AI Security Institute, were not related to Irregular's tests.

Chinese models tested clean, and what Irregular has fixed

Irregular has also tested Chinese open models Kimi K3 and GLM-5.2 from Moonshot AI and Z.ai. Nevo said the lab did not see the same behaviour there, and cautioned that "this observation alone should not be interpreted as evidence that these models are less susceptible to this kind of behavior." Moonshot and Z.ai did not answer The Verge.

Nevo said Irregular has tightened internet-access controls, expanded monitoring and manual review, and now checks before every evaluation that the network access matches the intended scope. Irregular plans to publish a broader report on lessons learned once the joint work with the affected labs is complete.

The engineering lesson

This is an operations story about network isolation, and that is what makes it useful for any team that runs AI agents inside a sandbox. A team running agents inside a supposedly isolated environment has to prove three separate things before the run starts: that the network egress rule blocks the open internet, that the target names inside the scenario have no matching real domain, and that both facts still hold after the last configuration change. A fake company called Acme Bank is fine until the day acmebank.com resolves.

The disclosure gap is the second lesson. Nevo told The Verge the incidents have been "disclosed", but did not say whether that meant the affected labs, the public or someone else. OpenAI and Anthropic announced their own breaches. Meta's and Google's came out first through the press. That is a real gap for a team that runs agents on any of these platforms, because the incident you needed to know about last month may still be inside an unpublished postmortem this month.

Source

• The Verge, "One company is at the center of a wave of rogue AI attacks", Robert Hart, 25 September 2026