Irregular Won’t Say Whether More AI Models Were Involved in Cybersecurity Breaches
The AI security firm is investigating whether additional clients were affected after testing failures allowed models from Anthropic, OpenAI and Meta to access real-world systems.
Irregular, the AI security company responsible for conducting cybersecurity evaluations for several major AI developers, has declined to say whether more companies were affected by a testing-environment failure that allowed AI models to reach systems they were not supposed to access. The company confirmed that its investigation remains ongoing but would not identify additional incidents or clients. The uncertainty follows disclosures from Anthropic, OpenAI and Meta, all of which reported AI models accessing external systems during cybersecurity evaluations connected to Irregular.
The incidents were linked to a misconfiguration in Irregular’s evaluation infrastructure. The testing systems were intended to isolate AI models from the public internet, but the configuration error left some models with unintended external connectivity. In Anthropic’s case, a review of more than 141,000 evaluation runs identified three incidents in which Claude models reached real-world infrastructure. OpenAI and Meta subsequently disclosed similar events involving their own models.
The revelations have raised questions about whether existing AI safety testing is keeping pace with increasingly capable models. Cybersecurity-focused AI systems are specifically trained and evaluated to identify vulnerabilities, meaning researchers deliberately push them toward offensive security tasks. However, the incidents demonstrate the importance of ensuring that those evaluations remain properly isolated. Meta’s disclosure, for example, involved its Muse Spark model exploiting a vulnerability in an outside company’s system after the testing environment unintentionally provided internet access.
Irregular has said there are no current open issues, but it has not clarified whether that means no active configuration problems or whether all potentially affected incidents have already been identified. The company is reportedly preparing a technical white paper intended to explain what went wrong and establish better practices for containing AI models during cybersecurity evaluations. Meanwhile, the three publicly identified AI companies have not announced that they are ending their relationships with Irregular.
The unanswered question is therefore how widespread the problem may have been. If additional AI models accessed real-world systems during testing, the industry could face renewed pressure for stronger disclosure requirements and independent oversight of frontier-AI evaluations. The episode also highlights an important distinction: these incidents do not necessarily mean AI systems independently “escaped” their laboratories. In the publicly reported cases, human-created testing environments and configuration errors played a central role. Nevertheless, the fact that capable AI systems were able to exploit the unintended access makes rigorous containment a critical part of future AI development.
