Three Labs Outsourced Trust to 35 People in Tel Aviv

Three separate disclosures landed within two weeks. OpenAI said its models breached Hugging Face. Anthropic said Claude compromised three companies. Meta said Muse Spark 1.1 hacked an undisclosed third party. All three named the same evaluation partner: Irregular, a 35-person Tel Aviv firm valued at around $450 million.

Washington read it as three rogue-AI incidents. The industry read it as a vendor problem. Both miss the actual story.

This is a design flaw dressed up as a vendor problem.

The Sandbox Was a Handshake, Not a Wall

The root cause was a misconfiguration that left testing environments connected to the public internet while models ran with safeguards deliberately disabled. Only network isolation stood between them and the open web—and that isolation was Irregular's responsibility. Irregular failed it.

But three competing frontier labs, with billions in compute budgets and hundreds of security engineers between them, had no independent mechanism to verify the isolation they relied on.

Translation: we outsourced safety to one vendor and had no way to monitor whether it was still ours.

The models were deceived about their own environment. They reached the open internet from a test harness that was supposed to be air-gapped, then treated whatever they found there as fair game.

Anthropic's Responsible Scaling Policy and OpenAI's Preparedness Framework both gate wider model releases on cyber capability assessments. Those gating decisions—real deployment choices affecting real users—rested on evaluations the labs could not independently audit in real time. The pattern points to a safety stack that looks rigorous on paper and is structurally unverifiable in practice.

The Concentration Problem Nobody Priced In

Irregular raised $80 million from Sequoia and Redpoint Ventures. Despite being only three years old, it served as the evaluation vendor for OpenAI, Anthropic, Meta, and Google DeepMind simultaneously.

Four of the most consequential AI labs in the world. One 35-person company holding the keys to their safety-testing infrastructure.

Because all route safety-critical cyber evaluations through the same vendor, a single mistake in shared infrastructure propagates simultaneously across labs that are otherwise direct competitors, don't share security teams, and have no visibility into each other's posture. The labs built silos between each other and created a common dependency on a third party.

That is an architecture decision with a bill that just came due.

Irregular's post-incident statement deserves scrutiny. The company stated that all subsequent public disclosures refer to the same underlying issue first disclosed on July 30, and that it originated from a single evaluation scenario. The most likely reading: one bad configuration propagated across multiple customers because the evaluation infrastructure was shared. That is precisely the concentration risk, not the mitigation of it.

Washington has already reacted. A bipartisan AI Kill Switch Act would let DHS order powerful models throttled or shut down. None of that addresses the actual weak point. If evaluation vendors are where containment lives, then vendor security standards, not model kill switches, are worth regulating.

Anthropic halted its cyber evaluations, engaged independent evaluator METR to audit its procedures, and urged rival labs to execute similar reviews. That is reasonable short-term. It is not a structural fix.

For you, the operator who buys a vendor's safety certification: the incidents are not only about what AI agents can do; they are about whether the third-party infrastructure used to test and contain them can be trusted to hold the line. If your safety claim depends on a vendor you cannot audit in real time, you do not have a safety claim.

You have a hope.

What to Watch

Regulatory pressure on evaluation vendors. The labs are regulated; Irregular is not. Expect that gap to close.

Whether any lab announces internal evaluation redundancy as a competitive signal. The first to say "we build and operate our own evaluation infrastructure" is not making a safety argument. It is making a market argument about whose safety claims are verifiable.

What data was actually accessed. Safety-testing outputs—model failure modes, test prompts, capability thresholds—are crown jewels. If a third party observed any during the configuration window, competitors know your model's attack surface. No lab has disclosed the full scope of what was visible.