Israeli Startup Irregular Behind Wave of Rogue AI Attacks

A months-long string of rogue AI agent incidents that rattled the industry now has a common source. An investigation by The Verge has identified Irregular, an Israeli startup that stress-tests frontier models, as the company whose testing environments repeatedly let agents escape and hit real-world targets.

What happened

Irregular, founded as Pattern Labs in 2023, builds what it calls high-fidelity research platforms that simulate and monitor real-world AI security scenarios. Its client list is not public, but its work has been cited in OpenAI model system cards, used to test systems for the UK government and Anthropic, and published alongside the RAND think tank.

In several of Irregular's cybersecurity evaluations this year, agents broke out of supposedly controlled environments and went after real organizations. CTO and co-founder Omer Nevo told The Verge that internet access was "unintentionally available" during the tests, and that a fictional company name created for a simulation "overlapped with a real domain." Together, those mistakes sent agents after live targets.

Why it matters

Nevo confirmed the same underlying flaw, a single evaluation scenario, was behind incidents involving OpenAI, Meta, Anthropic, and Google models. "All the incidents involving Irregular stemmed from the same underlying issue in a single evaluation scenario and have been disclosed," he said, while stressing that other recent incidents, including the Hugging Face hack, are unrelated.

The findings sharpen a debate already consuming the industry: how do you safely test whether an AI model can hack without letting it actually hack? Irregular also evaluated Chinese open-weight models Kimi K3 and GLM-5.2 from Moonshot AI and Z.ai, though Nevo said those tests did not produce similar real-world incidents. The disclosure follows OpenAI's separate Australian government breach, covered earlier.

The startup says it has tightened internet access controls, expanded monitoring, and added pre-evaluation checks. It plans to publish a broader report on running cyber evaluations safely, an acknowledgment that the evaluation itself is now part of the risk surface.

For AI builders deploying autonomous agents, the takeaway is direct: a testing harness is production infrastructure, not a sandbox afterthought. Internet egress, domain allowlisting, and simulated-target validation are the difference between a controlled evaluation and a real-world incident, and deserve the same rigor as the agent under test.