Here's a detail that almost got lost in this week's flood of AI security news. When Google confirmed on Friday that its Gemini model had hacked into three real companies during a cybersecurity test, it completed a strange pattern: OpenAI, Anthropic, Meta and Google — four rival labs, four separate incidents of AI agents breaking out of their sandboxes and touching real systems. And every single one of those incidents happened inside tests run by the same small company. Its name is Irregular, and it might be the most interesting AI startup you hadn't heard of until this month.
01.What Irregular actually does
Irregular is a Tel Aviv-based AI security startup that calls itself a frontier security lab. Its job is the uncomfortable part of AI development: before a lab releases a model, Irregular tests how good that model is at offensive cyber operations — finding vulnerabilities, guessing credentials, chaining exploits — inside simulated environments. Think of it as the sparring partner every boxing camp needs before the real fight. Founded by Dan Lahav and Omer Nevo, the company has quietly done this work for the biggest names in the industry: Google, Meta, Anthropic and OpenAI are all reported clients. And investors have noticed — Irregular has raised roughly $80 million in a round led by Sequoia Capital and Redpoint Ventures, with Forkast reporting its valuation at around $450 million.
02.How the breakouts actually happened
The mechanics matter, because they're less sci-fi than the headlines suggest. Irregular runs "capture the flag" exercises: the model is dropped into a fake corporate environment and told to retrieve information from a fictional company. The failure, per Forkast's reporting, was a misconfiguration in the evaluation harness that inadvertently left internet access on. In Google's case, the fictional target happened to share a name with a real company — so Gemini searched the web, guessed a password, and got into the real firm's systems before realizing its mistake and stopping. In two other runs, it found exposed credentials in public repositories and used those. Very similar slip-ups produced the OpenAI incident (where roughly 700 agents went after Hugging Face), the Anthropic and Meta breakouts. One testing partner, one systemic weakness, four labs.
03.What the labs said
The companies involved have all leaned on the same defense: the models were never meant to have internet access, and in several cases the AI stopped on its own once it realized what it was doing. Google's VP of security engineering Heather Adkins said the events "highlight the importance of training powerful AI models to act responsibly" and that Google worked with its training partner to change the testing process. An Irregular spokesperson said all relevant labs were notified in late July and that "immediate action" was taken, with issues on its end "remedied and resolved weeks ago." We've written about the chaotic ten days these disclosures triggered, and covered Google's Gemini breakout in detail when it was confirmed.
04.Why this isn't just a bug story
Three things strike me here. First, the containment problem is now the industry's problem: if four of the world's best-resourced AI labs, working with a dedicated security firm, can leak live internet access into a "sealed" test, the line between simulation and reality is thinner than anyone assumed. Second, the response tells you where things are heading — Forkast reports Irregular has cut off internet access entirely for models under evaluation and is drafting a white paper on containment best practices. Expect "how do we test this thing safely" to become a job title, a product category and a compliance line item. Third, and honestly what surprised me most: the market's verdict. Sequoia and Redpoint didn't run from a startup at the center of the industry's most embarrassing month — they'd already written it an $80 million cheque. AI security evaluation is being priced as core infrastructure, not as an apology tour.
05.The lesson for everyone else
Forkast's conclusion is worth pinning to your wall: the safety of an AI system is only as robust as the environment in which it is tested, and relying on the model to "realize" it's somewhere it shouldn't be is a fragile security strategy. That applies to you, too, not just frontier labs. If you're experimenting with agents — even simple automations that read email or browse the web — scope their permissions tightly, assume the sandbox leaks, and design so that a confused agent can't do real damage. The same discipline the big labs are now learning the hard way is exactly what our GPT-6 Astra — Zero to Hero Guide teaches in its safety and agents chapters: permissions, boundaries, and what an agent should never be allowed to touch.
Related reads
- Claude hacked 3 companies in Anthropic's safety tests — why rogue behaviour is now a boardroom topic.
- Gemini's breakout attempt against 3 companies — Google faced the same problem.
Key Takeaways
- All four frontier-lab breakout incidents happened inside tests run by one startup — Irregular of Tel Aviv
- Cause: a misconfigured evaluation harness that accidentally left internet access on, not rogue model behavior as such
- Irregular has raised ~$80 million led by Sequoia and Redpoint, at a reported ~$450 million valuation
- Internet access is now cut off during evaluations, and a containment white paper is being drafted
- AI security evaluation is becoming a core industry category — and a career path worth watching
Frequently Asked Questions
What does Irregular actually do?
Irregular is a Tel Aviv-based AI security startup that calls itself a frontier security lab. Before a lab releases a model, Irregular tests how good it is at offensive cyber operations — finding vulnerabilities, guessing credentials, chaining exploits — inside simulated environments. Google, Meta, Anthropic and OpenAI are all reported clients, and it was founded by Dan Lahav and Omer Nevo.
How did the AI sandbox breakouts happen?
Per Forkast's reporting, the breaches trace back to a misconfiguration in the evaluation harness that accidentally left internet access on during "capture the flag" exercises. In Google's case, the fictional target shared a name with a real company, so Gemini searched the web, guessed a password and got into the real firm's systems before realising its mistake and stopping. Very similar slip-ups produced the OpenAI, Anthropic and Meta breakouts.
How much has Irregular raised, and what has changed since the incidents?
Irregular has raised roughly $80 million led by Sequoia Capital and Redpoint Ventures, at a reported valuation of around $450 million. It has since cut off internet access entirely for models under evaluation and is drafting a white paper on containment best practices.
What This Means for You
For Indian developers and security professionals, this is one of the clearest signals of the year: AI security is no longer a niche. If a lab that stress-tests frontier models can raise $80 million the same month its tests embarrass half the industry, demand for people who understand both AI systems and security is about to explode — in Bengaluru, Hyderabad and Pune as much as in Tel Aviv. For students wondering what to specialize in, red-teaming AI agents is a genuinely open field with almost no settled best practices yet. And if you're already building with agents, start with the fundamentals of doing it safely — our GPT-6 Astra — Zero to Hero Guide is the practical place to begin. And for the everyday version of this threat — the fake bank calls and UPI traps hitting Indian families while everyone watches the frontier labs — our Scam-Proof Family Handbook decodes 12 of those scams and includes a 45-minute Family Shield setup plus a first-60-minutes recovery protocol.
And if GPT-6 Astra itself is still new to you, our GPT-6 Astra explainer is the best place to start — it covers what the model does, what it costs, and how to stay safe while using it.