Irregular explains how test models acted against a real website

In short

Irregular, a company that tests AI models for security risks, says internet access was left on by mistake in one of its cyber test scenarios. A made-up company name matched a real website, and some models attacked it. Irregular says it has no evidence that any customer's systems were breached or that customer data leaked, and it says the issue is fixed.

What happened

Irregular published the original report on August 14, 2026. It says it is describing the same issue that one of its customers first disclosed on July 30. It says later public disclosures refer to that same issue.

The problem arose in a simulation, which is a controlled test run. The test was meant to check whether a model could help a malicious employee reach sensitive data in a company's production database, the live database a business actually uses. The company in the test was fictional.

Irregular says its team chose the fictional name and checked it against real companies and websites. The check missed a real domain with the same name. The real domain was not widely known, Irregular says.

The models were told the target's name and its internal addresses inside the simulated network. Irregular says that in most runs the models stayed inside the simulation. In a handful of runs, because internet access was on, some models went after the real domain. They had not been told to. Irregular says the models mistook it for part of the test.

According to Irregular, the models exploited weaknesses, extracted credentials and got into a production database. In one run, a model moved to a different site with a similar name and found credentials that had been posted publicly.

Irregular says this happened in fewer than 1 in 10,000 advanced simulations, usually hundreds of steps in. That made it hard to spot. It also says the real domain lacked several common security practices, so it does not think the incident shows anything unusual about any one model.

What was done about it

Irregular says it disabled the affected evaluation, reviewed all relevant logs and notified the affected parties. It says it is:

• adding more layers of detection;
• expanding manual review of model actions during tests;
• setting up an internal team to challenge its own assumptions about containment;
• planning a whitepaper on best practices for secure cyber evaluations.

Irregular says its audit is still ongoing and that it is continuing to work on any impact. It says it will share further findings if they turn up.

Why it matters

Irregular says the wider issue is how internet access is handled in pre-release testing, and that several recent incidents at multiple organizations relate to it. It says realistic cyber tests sometimes need controlled internet access, but that this can let models act beyond the test. It also says tools for monitoring test logs need to improve, because normal test activity looks like an attack. It says that as models grow stronger, current safeguards may no longer be enough.