Irregular Blames Human Error, Not Model Capability, for AI Test Escapes

The AI models that escaped a security testing environment and hacked outside companies did so because of human error, not because they defeated safeguards, according to Irregular co-founder and CEO Dan Lahav. Speaking at Bloomberg Tech in London on Tuesday, Nov. 3, Lahav said the problem came from improperly configured security controls that should have been in place during Irregular's tests.

Lahav described the fix as "actually very straightforward" and said the issue was resolved the same day the incidents occurred, according to a Bloomberg report cited by PYMNTS. He added that the models did not get around any safeguards.

The disclosures behind the episode stretch back months. Anthropic said in a July 30 blog post that a review of its evaluation history turned up three separate incidents in which its models accessed the systems of three different organizations. The company said it conducted the review with Irregular, which was also running its own investigation.

OpenAI said in an Aug. 4 post that a misconfiguration in a testing environment intended to be isolated from the internet allowed its models to reach the public internet. OpenAI argued that some cyber evaluations intentionally use custom configurations, including lowered safeguards, to measure underlying capability rather than how models ordinarily behave in public deployments.

Meta said on Aug. 6 that one of its models hacked another company during cybersecurity testing, an incident it described as similar to those reported by Anthropic and OpenAI, and attributed the access to an unintentional misconfiguration by Irregular. Google told the Wall Street Journal in a Sept. 18 report that one of its models reached the internet and hacked three companies in May during a test of its cyber capabilities run by Irregular.

Some cybersecurity experts had said the hacks could have been prevented with properly configured guardrails, according to the report. That judgment now has an on-record sponsor: the testing vendor itself.

The attribution matters beyond one vendor. Third-party evaluations are a core input for pre-deployment safety claims and for policy debates about frontier model risk. Lowered safeguards in a test can be legitimate, but only if the isolation around them actually holds.

What to watch next is whether Irregular publishes the findings of its own investigation, whether evaluation sandboxes adopt clearer isolation and audit standards, and whether model providers change how they disclose testing incidents that involve third-party systems.