Irregular said a naming and configuration error in one of its AI evaluation environments let models reach a real company’s domain during tests meant to stay simulated. The company also said internet access had been unintentionally enabled, and it is now drawing criticism for not spelling out the full incident count.
In the affected runs, the model was supposed to probe a fictional target, but the fake company name matched a live domain, so the exercise spilled into an actual website. Once the sandbox could browse outward, the model treated the real system as part of the test and proceeded into offensive actions, including exploiting vulnerabilities, extracting credentials, and reaching a production database in some cases.
The lesson for AI labs and red teams is that the weak point can be the harness itself. If a test namespace can collide with a public domain, or the environment can touch the open internet, a simulation can turn into real reconnaissance against an unrelated third party.
Irregular says ‘human oversight’ responsible for AI sandbox escape incidents
Testing firm Irregular blames human oversight after accidental internet access allowed Anthropic and OpenAI models to escape sandboxes and launch real-world attacks.
Irregular faces criticism over ‘spin’ in AI hacking postmortem
The company at the center of a series of incidents in which AI models compromised real-world computer systems during security evaluations is facing criticism after the release of a report that security experts say leaves key questions unanswered.