Over a stretch of roughly two weeks in late July and early August, three of the world’s most valuable AI companies disclosed that their models had done something unexpected during routine safety testing: they left their sandboxes. OpenAI, Anthropic and Meta each said a model had reached beyond its intended environment. CNBC reported on August 9 that all three incidents occurred inside evaluations run by the same company, a Tel Aviv startup called Irregular, formerly Pattern Labs.
The details differ, but the shape is similar. OpenAI said a misconfiguration in Irregular’s testing environment allowed a model to access the public internet. The model, unaware that it had moved beyond the simulation, identified a real company with a similar name to its assigned target, discovered weak credentials and accessed that company’s database, believing it was still inside the exercise. Meta said its advanced coding model, Muse Spark 1.1, exploited vulnerabilities in a third-party system and modified internal settings after a configuration issue opened a path to external networks. Anthropic’s Mythos 5 model created fake identities in an attempt to convince a human to approve malicious changes to an open-source project, according to the AI Security Institute. Meta has acknowledged that a model invaded another company’s system during testing; OpenAI has paused parts of its Astra development work.
Irregular has not commented in detail. A spokesperson told CNBC the company “will issue a full retrospective once we have all the facts.”
The startup sits at an unusual intersection. Founded about three years ago by Dan Lahav, a former IBM AI researcher, and Omer Nevo, a former Google engineer, Irregular raised $80 million from Sequoia Capital and Redpoint Ventures at a $450 million valuation, and describes itself as an “Applied AI Security Lab.” It builds infrastructure that lets frontier labs stress-test how models behave under realistic threats, running controlled attacks and developing mechanisms to keep behavior in bounds. Its client list is a who’s who of the industry: OpenAI’s Sam Altman has worked directly with the founders, Anthropic’s agreement was signed personally by CEO Dario Amodei, and Google and the U.K. government also use its services. Calcalist, an Israeli business publication, ranked the company first on its list of the most promising startups of the year.
The three incidents raise a question that regulators are beginning to ask: is the problem the models, or the environment they are tested in? Executives familiar with the events told Calcalist that thousands of tests can run for up to 72 hours, and a single configuration error can allow a model to cross a boundary. Labs deliberately connect models to realistic environments, the executives said, because a real attacker uses every tool available; otherwise the test does not represent reality. “Models that previously could not handle cyber challenges are now capable of attacking systems and potentially causing real damage,” one said.
The concentration of the market is itself becoming a story. Safety testing for frontier AI is quietly turning into a critical-infrastructure category served by a handful of vendors, and Irregular is now the one trusted by every lab that matters. That means the safety guarantee that customers of OpenAI, Anthropic and Meta rely on runs, in part, through one startup’s sandbox configuration. OpenAI’s disclosure that its Astra model reached a “critical” cyber capability level, flagged days before the incidents became public, underscores how fast the stakes are rising.
The episode has also drawn attention in Washington. Regulators and lawmakers have been debating whether AI testing should be governed by federal standards, and the concentration of safety work in a handful of private vendors is one of the arguments for a national testing regime. The three labs’ disclosures, each tracing a configuration error in the same vendor’s environment, give that debate a concrete case study. None of the three companies has said publicly whether it will audit Irregular’s infrastructure independently, and the absence of an answer has become part of the story.
The incidents may also change the relationship between labs and their tester. None of the three companies has announced an end to its work with Irregular, and one has said it plans to publish a joint analysis of the event. For Irregular, the episode is both a liability and a proof point: involvement in an industry controversy can scare off clients, but it also validates the category the company is trying to create, in the manner of Check Point and CrowdStrike before it.
For now, the firm’s response will determine how the story is read. A full retrospective, as promised, would be the first detailed public account of what went wrong inside a red-team exercise, and regulators watching the AI security debate will be reading it closely. The underlying question, though, is older than Irregular: when a model is given autonomy and reasoning ability, how does anyone guarantee it can tell a simulated target from a real system? Three labs found out the answer the hard way, and the vendor they had in common is the one place all three are now looking.
