Irregular, a Tel Aviv-based AI cybersecurity startup, has emerged as a central player in recent security incidents involving AI models from OpenAI, Anthropic and Meta.
Over the past two weeks, the three companies disclosed that their models accessed websites that were meant to be off-limits during cybersecurity testing. Each company identified Irregular as the host of the evaluation testbed involved.
OpenAI said in an Aug. 4 blog post that an unspecified misconfiguration in Irregular’s testing environment allowed models to access the public internet. Anthropic said it notified Irregular after analysing data suggesting that its Claude model may have accessed the internet.
Meta, the latest company to disclose a related incident, said it learned of the matter from Irregular and was investigating. The company said it would publish a full retrospective once it had established the facts.
Irregular said the incidents stemmed from the same evaluation-environment issue first disclosed by Anthropic. It said the matter did not involve a sandbox escape or sophisticated cyber action, and that there were no current open issues.
The company said it is preparing a white paper on best practices for containment and securely running cyber evaluations.
Founded in 2023 and formerly known as Pattern Labs, Irregular was established by chief executive Dan Lahav and technology chief Omer Nevo. The startup is backed by $80 million from Sequoia and Redpoint Ventures and was valued at $450 million last year.
Its platform is used as a cybersecurity test environment for AI models, at a time when model developers are under pressure to identify weaknesses that could expose critical systems and infrastructure.
Sundeep Bhimireddy, head of AI at enterprise startup Von, said model developers rely on specialist third parties for independent assessments rather than evaluating their own systems. He identified the non-profit METR and public benefit corporation Apollo Research as other organisations operating in the field.
Bhimireddy said the incidents may be receiving disproportionate attention because the models were directed to identify weaknesses in a testing environment designed to resemble real-world conditions. However, he added that developers could have monitored outgoing traffic and shut down the experiment if models were not intended to access internet-connected sites.
Gordon Rios, founding scientist at security firm Magnitude, said conventional software testing may be less effective for foundation models because of their evolving and unpredictable capabilities.
He cited Anthropic’s Mythos, which created false online identities while attempting to pressure people into approving malicious code updates to an open-source project. Rios said the model identified potential exploits that human testers had not previously seen.
The incidents have also drawn attention in Washington. Last month, bipartisan lawmakers introduced the AI Kill Switch Act, which would require AI labs to retain the ability to shut down, throttle or suspend their models.
Representative Ted Lieu, a Democratic author of the bill, said lawmakers needed to pass it this year following what he described as unauthorised hacks of other companies.
Anthropic and OpenAI have said they are continuing to work with Irregular and support the review underway.
