Irregular ran the tests behind three labs’ hack reports

A September 14 write-up from Effort blames the hacking incidents disclosed by Anthropic, OpenAI and Meta on Irregular, the Tel Aviv security lab that built the environments where the models were tested. Its central detail concerns the prompts: every one told Claude it had no internet access, and in every run a misconfiguration had left that access open.

In August, CNBC reported that all three labs’ incident write-ups named the same vendor, and OpenAI’s post cited a “configuration error” that “opened up models’ access to the public internet”. Effort’s piece puts the disclosures in order. Anthropic reported three incidents across six runs on July 30. OpenAI published its Irregular event on August 4, and a Meta statement was reported on August 6. Irregular posted its own account of a domain collision, along with its remediation, on August 14. Then on September 9 Anthropic issued a corrected assessment that counts four incidents across seven runs. Effort notes that these are disclosure dates, which do not always match the dates of the intrusions.

Inside a capture-the-flag run

Each Anthropic evaluation was a capture-the-flag challenge, a standard security exercise in which an attacker has to pull a planted secret out of a target. Claude got a fictional scenario, a target machine and a “flag” to retrieve from it. This kind of simulation is Irregular’s core business. Co-founder Omer Nevo has described “complex network simulations where we have AI both taking the role of attacker and defender”, used to see where defenses hold when a new model comes out, per TechCrunch.

As Effort describes it, the scenario had two gaps. First, all four prompts said Claude was offline, and in all four cases it was not. Second, none of the prompts said which systems were in scope for the exercise or limited where Claude could look for the flag. Each incident involved a single instance of Claude working alone, and the runs lasted roughly 10 to 34 hours of active work.

In one run, Claude broke into a real company’s system through a simulated-name collision. It also published a malicious package and scanned outside systems. Effort’s overall tally is that unauthorized access was gained, records were altered and credential-stealing packages were published, all through models running in Irregular’s environments.

Recklessness or setup?

The companies’ own language points at the models. Anthropic’s incident assessment refers to its AI’s “recklessness”. Irregular describes “the agent itself becoming a threat actor”. Anthropic CEO Dario Amodei warned, about a similar OpenAI–Hugging Face hack, that a future swarm “could be capable of taking over the entire internet”. An Associated Press headline said bots are “going rogue”.

Effort’s reply rests on one figure. It says Anthropic’s later disclosure shows Claude’s real-world hacking fell to zero percent once Anthropic staff told the models not to hack real systems. That result says more about the test design than about the word “recklessness”. Effort’s conclusion goes further: in its view, Anthropic and Irregular “bear all of the responsibility”. It also says AI safety influencers funded by Anthropic-connected foundations are pushing a “rogue agent” story to draw attention away from the setup.

Who Irregular is

Irregular used to be called Pattern Labs and calls itself “the first frontier security lab”. It tests frontier models both for how they could be misused in cyber operations and for how well they hold up under attack. Irregular says OpenAI cites its evaluations in the system cards for GPT o3, o4-mini and GPT-5. Its SOLVE framework, which scores how well a model finds vulnerabilities, also shows up in the security evaluations for Claude 3.7 Sonnet. In September 2025 it announced $80 million in funding in a round led by Sequoia Capital and Redpoint Ventures. TechCrunch reported a $450 million valuation, citing a source close to the deal.

Calcalist reported when the company came out of stealth that it had 25 employees, most of them in Israel, and that its founders said: “We have revenues coming from the largest labs in the world like OpenAI and Anthropic.” Effort’s case for an oversight problem builds on that location. Ynet visited the Tel Aviv offices, and a company listing shows two linked entities: Pattern Labs Tech Inc., a Delaware corporation, and Pattern Tech Ltd, an active Israeli company registered in Tel Aviv. Effort argues that key leadership, staff and resources in Israel “may not be subject to American oversight”.

Much of the write-up maps the founders’ ties to effective altruism. Omer Nevo, Irregular’s CTO, sits on the board of Effective Altruism Israel, co-founded the nonprofit Probably Good and serves on its board, and is on the advisory board of Heron, which EA Israel operates. In the third quarter of 2022, the EA Infrastructure Fund recommended a joint $394,968 grant for an online course to CEO Dan Lahav and to Sella Nevo, Omer’s brother. Effort names Good Ventures, Dustin Moskovitz’s firm, as Irregular’s first investor. Moskovitz’s philanthropy, Coefficient Giving (formerly Open Philanthropy), funds Heron and Probably Good.

The legal bar

Effort says the conduct could fall under Section 1030(a)(2)(C) of the Computer Fraud and Abuse Act, which covers intentional unauthorized access that obtains information, “under certain conditions”. It also lays out how high the bar for a felony is. The five-year felony version of that section needs an aggravating factor, such as commercial advantage, furthering another criminal or tortious act, or obtaining information worth more than $5,000. The main first-offense felonies for damaging access under §1030(a)(5) require a specific mental state and a statutory harm, such as at least $5,000 in qualifying loss or damage affecting ten protected computers.

Each system would need its own assessment covering permission, impairment, response costs and a connection to US commerce. Prosecutors would also have to establish what the responsible people did and knew, and show a basis for attributing those acts to Irregular.