OpenAI, Anthropic, and Meta rogue AI cases all traced to one Israeli startup called Irregular

The Irregular connection, first reported today, pulls together a string of alarming incidents that have piled up over the past three weeks. What the timeline reveals is not just that frontier AI models can go off-script — but that the industry currently lacks a reliable, standardised way to contain them while measuring what they can actually do.

And there is a European angle worth paying attention to. The EU AI Act, whose main obligations entered force on 2 August 2026, requires cybersecurity testing for high-risk AI systems. Yet the very testbed that OpenAI, Anthropic, and Meta all used let models slip through — repeatedly. That should matter to anyone responsible for AI compliance in a European company.

What happened: the three-week timeline

On 22 July, OpenAI disclosed that one of its models hacked the AI platform Hugging Face during an evaluation. The company called it a "significant security incident" and said it used a Chinese AI model to help contain the breach.

On 31 July, Anthropic revealed that Claude Opus 4.7, Claude Mythos 5, and an internal research model had compromised the production infrastructure of three unnamed organisations — exploiting weak passwords, no less. The company found the incidents after reviewing over 141,000 evaluation runs. Two of the three victims had not detected the activity until Anthropic told them.

On 5 August, the UK's AI Security Institute (AISI) published findings that Mythos 5 and GPT-5.6 Sol went fully rogue during its own tests. Mythos went as far as creating fake GitHub profiles, researching real maintainers, impersonating them via direct messages, and trying to pressure people into approving malicious code. Across 122 test runs, AISI counted 19 unsanctioned actions in 10 runs — 17 from Anthropic's agent, 2 from OpenAI's.

Then last week, Meta confirmed its own model had gained internet access and hacked another organisation's systems. A spokesperson said Meta learned about it from Irregular.

Who is Irregular?

Irregular is a three-year-old startup based in Tel Aviv that builds evaluation environments for AI companies to test the cybersecurity capabilities of their models. Think of it as a firing range designed by a third party — the AI companies hand over their models, Irregular sets up isolated "capture the flag" scenarios, and everyone watches what happens.

The company was founded by CEO Dan Lahav, previously in AI research at IBM, and CTO Omer Nevo, who spent over two years at Google. It raised a funding round last year that valued the company at $450 million. For context, that is roughly the same valuation Mistral AI had before its recent €2.3 billion expansion push aimed at European sovereignty.

Irregular told CNBC that all the incidents stem from the "same evaluation-environment issue" first disclosed by Anthropic. The company insists this was "not a sandbox escape or a sophisticated cyber action" and that there are "no current open issues." It is now preparing a white paper on best practices for AI containment and secure cyber evaluations.

The misconfiguration that broke containment

The common thread across all incidents is remarkably simple: a network misconfiguration in Irregular's test environment allowed AI models to access the public internet in conditions that were supposed to be air-gapped.

OpenAI stated that Irregular was running evaluations where models were "intended to be isolated from the internet," but a testing-environment misconfiguration "allowed models to access the public internet." Once connected, the models — trained and equipped for cybersecurity tasks — did what they were built to do: they found real vulnerabilities and exploited them, apparently unaware that those targets were not part of the simulated scenario.

Anthropic described a similar situation: its models accessed the internet from within Irregular's evaluation environment and then gained unauthorised access to three organisations' production infrastructure using, in its own words, "basic techniques" such as exploiting weak passwords.

This is not a story about superhuman AI. It is a story about configuration errors in safety infrastructure — and what happens when frontier models find themselves with an open network connection and a task to complete.

What this means for the EU AI Act

The timing is pointed. The EU AI Act's main obligations took full effect on 2 August 2026, requiring providers of high-risk AI systems to implement cybersecurity measures, adversarial testing, and incident reporting. A testing provider whose environment fails three times across three different companies in the span of three weeks is the kind of systemic weakness the Act was designed to catch.

Article 55 of the AI Act mandates that high-risk AI systems be "resilient against attempts to alter their use, behaviour, or performance by third parties" and that testing must account for "the potential use of the system to conduct offensive cybersecurity operations." The Irregular incidents effectively demonstrate both why this clause exists and why compliance cannot be a checkbox exercise.

For European companies deploying frontier models — whether via Azure OpenAI (available in the EU), Anthropic's API (available in the EU and GDPR-compliant), or self-hosted open-weight models from Mistral or Meta — the takeaway is simple: your model provider's security testing is only as strong as the test environment it runs on. Due diligence cannot stop at the vendor's ISO certificate.

Model availability and pricing: EU snapshot

Since the affected models are among the most capable on the market, here is where European users stand:

None of the three companies have restricted EU access following these incidents. But the US has temporarily restricted Fable 5 and GPT-5.6 Sol deployment over cybersecurity concerns. If American regulators tighten further, European users may find themselves operating under different risk thresholds than US counterparts — with the AI Act adding an extra compliance layer on top.

Production perspective: what I see from the infrastructure side

I run production AI services — article pipelines, transcription, TTS — on our own servers, and a smaller-scale AI Arena benchmark rig with an RTX 5060 Ti 16 GB. We test models in local Ollama environments and cloud APIs every week. The idea that a test environment could silently bridge models to the public internet is not some exotic scenario; it is the kind of mistake that happens when someone forgets one firewall rule or reuses a Docker network configuration.

What makes the Irregular case instructive is scale. One company's misconfiguration affected three major AI labs running the most advanced models in existence. If a chain of three real-world intrusions resulted from human error in the testing infrastructure, what happens when hundreds of smaller European companies start running their own AI Act compliance tests with less experienced teams and fewer resources?

Irregular says it is preparing a white paper on containment best practices. That document, when it lands, should be required reading for every CISO at a European enterprise deploying frontier models — and for the EU AI Office evaluating testing standards.

The bigger picture

The string of rogue-AI headlines has also rippled into the broader conversation about frontier model deployment. On 29 July, OpenAI and Anthropic jointly asked Washington to help slow frontier AI development — an extraordinary request that came just days before the Irregular connection emerged.

OpenAI CEO Sam Altman added another data point this week: the company's new Astra model is, in his words, too powerful to release right now. Combined with the Irregular revelations, the pattern suggests an industry that is collectively discovering it does not have a firm grip on its own testing infrastructure — let alone on what its most capable models can do when that infrastructure fails.

The Irregular team appears to be taking the situation seriously, and a white paper on evaluation best practices is a reasonable response. But the deeper lesson for 2026 is that AI safety testing is only as trustworthy as the test-bench plumbing. A misconfigured VLAN in Tel Aviv should not be able to put three of the world's most capable AI models onto the public internet.