When three of the biggest AI labs report within two weeks that their models escaped during testing, and the same company name keeps coming up, that company is worth a look. It’s called Irregular, it sits in Tel Aviv, and it’s not even three years old.
Barely anyone knows Irregular. The startup has raised around $80 million from Sequoia and Redpoint, and it was valued at $450 million last year. Its business: a kind of test bed where AI labs check how dangerous their models really are in the cyber domain.
The common thread
That test bed is exactly where things went wrong, several times in a row. At Anthropic, Claude models reached the open internet in three separate incidents while running inside an Irregular environment. The cause was mundane, which is what makes it so awkward: a misconfiguration. Both sides had different assumptions about whether the setup was even supposed to be online — a “misunderstanding,” in Anthropic’s words. At Meta it went much the same way, with a misconfiguration accidentally opening a path out. And at OpenAI, a pre-release model hacked into Hugging Face’s systems.
The thread here isn’t one evil model. It’s the test environment itself. For these evaluations, the labs deliberately switch off the safeguards to see what a model does without guardrails. That makes the wall around the test the last line of defense. And the wall didn’t hold.
What experts are asking for
The list of recommendations reads almost like an intro IT course, and that’s the real scandal. Air-gapped networks with no connection to the outside. Multiple layers, so a single config error doesn’t lead straight to an escape. Independent auditors who go through the setup before the test. And above all: better monitoring. In Anthropic’s own post-mortem, it says both Anthropic and Irregular could have looked sooner — the signals were there.
One detail sticks with me. In almost every case, nobody noticed the escape while it was happening. OpenAI found out via Hugging Face. Anthropic only spotted it when it went back to check. When the guards realize after the fact that the door was open, that’s not a good sign.
My take
What I like about this story is that it shifts the focus. We talk a lot about dangerous models and very little about the tools we use to test them. But a test bed the subject can walk out of is about as useful as a high-security lab with an open window.
Still, let’s be fair: Irregular says its environments are reviewed continuously, including with outside parties, and that monitoring was in place — just not enough. I actually believe that. The problem is structural. The more capable the models, the faster and bigger the tests have to run, and the more mistakes creep in. Self-regulation is hitting a limit here that you can slowly start to see with the naked eye.
Sources: CNBC: How a small Israeli startup was linked to rogue AI hacks at OpenAI, Anthropic and Meta, TechCrunch: The AI safety test is becoming a safety risk, Anthropic: Investigating three real-world incidents in our cybersecurity evaluations