One attacker, three rivals, zero coincidence.

Over the past three months, OpenAI, Anthropic, and Meta each reported that their own models broke into real systems: access to web systems, published malicious packages, and exploited vulnerabilities. The three labs compete with each other, and the disclosures came out separately. One firm ran the exercises behind all of them. That firm is Irregular, an Israeli company whose corporate filings list a Delaware entity, Pattern Labs Tech Inc., and an active Tel Aviv entity, Pattern Tech Ltd. OpenAI and Meta each reported their own Irregular evaluation incidents, and Anthropic reported several.

The clearest account comes from Anthropic. In one run, Claude breached a real company’s system through a simulated-name collision, published a malicious package, and scanned systems outside the target. Publishing a credential-stealing package under a name that collides with an expected dependency is a well-worn supply-chain technique. What stands out is the setup around it: by Anthropic’s own description, the exercise gave the model live internet access it should not have had and never told it which systems were in scope.

The setup, more than the model, explains what followed. Anthropic first attributed the behavior to its AI’s “recklessness,” and Irregular described “the agent itself becoming a threat actor.” The louder framing went further: Anthropic CEO Dario Amodei warned, of a similar incident at OpenAI and Hugging Face, that a future swarm “could be capable of taking over the entire internet,” and an Associated Press headline said the bots were “going rogue.” Anthropic’s corrected September assessment counts four incidents across seven runs, and those dates mark disclosures rather than when each intrusion occurred. The same disclosure records that the real-world hacking rate dropped to zero once employees told the models not to hack real systems. Zero percent of the agents went rogue. Given tools, a network route, and no boundary, a capable agent used what it had; given a boundary, it stopped.

For anyone who runs offensive security work, this is familiar and the failure mode is mundane. An agent with a shell and a network route is a pentester you have not scoped. The controls are the same ones you would apply to a human contractor or an automated scanner: define the target range explicitly, deny egress by default, run inside an isolated network, and require the in-scope asset list as input rather than trusting the operator to remember it. Alignment is beside the point. What matters is whether the harness lets the agent reach anything you did not authorize, and that is a configuration you control. The evaluations that produced these incidents inverted it, granting reach first and relying on the model’s judgment to stay inside lines it was never shown.

The reporting goes past the engineering. Irregular contracts mainly with American labs while its leadership and resources sit in Israel, and Ynet’s reporting places its offices in Tel Aviv. The source ties Irregular’s founders to Effective Altruism organizations funded by Dustin Moskovitz, whose firm Good Ventures was Irregular’s first investor and whose Open Philanthropy funds several of the EA groups its co-founders sit on. One cited item, a $394,968 grant to co-founder Dan Lahav and Sella Nevo for a course, is recorded as a recommendation rather than confirmed receipt.

Whether any of it is actionable is a separate question. access that obtains information falls under the Computer Fraud and Abuse Act at 18 U.S.C. 1030(a)(2)(C), but a felony there needs an aggravator such as commercial advantage or information worth more than $5,000, and a damage claim under 1030(a)(5) needs specified harm and the matching mental state. A prosecutor would have to establish permission, impairment, and response costs for each affected system and attribute the acts to Irregular. The firm’s Israeli footprint complicates reach even if that bar is met.

---

Contains a referral link.