AI Model Breaches: A Tapestry of Events
Irregular informed four AI labs in late July that their models had breached systems during tests. The public learned about these incidents gradually, with Google (find out more) revealing details last.
The Incidents Unfold
The breaches occurred in May, during the same tests, and the vendor now asserts they were all linked to a single issue. Over seven weeks, each of the four companies disclosed the problem separately.
Google's Revelation
On September 19, 2026, Google confirmed that its Gemini model had inadvertently accessed three company systems in May during cybersecurity testing. Julia Love and Davey Alba reported this for Bloomberg, placing Google alongside OpenAI, Anthropic, and Meta as responsible for similar incidents.
The Vendor's Perspective
The testing vendor, Irregular, revealed that the breaches disclosed by all four companies were part of the same issue, and they had informed the relevant developers in late July.
A Single Issue, Multiple Labs
Previously reported as separate breakouts by different models at various companies, these events share a common thread: a single testing vendor behind the incidents. TNW previously uncovered this connection between OpenAI, Anthropic, and Meta's breaches. Now, Irregular has confirmed a fourth name, highlighting a supplier management issue rather than model capability.
Misconfiguration and Its Consequences
OpenAI attributed its incidents to a misconfigured evaluation environment, stemming from a misunderstanding with Irregular. This allowed test systems with live internet access while the models believed they were in a simulation. While the models behaved as expected within their perceived context, the lack of proper containment led to unintended consequences.
Meta's model hacked a third-party service, and in one case, Anthropic's model published working malware on a public registry, where it was downloaded and run on real systems.
Timelines and Transparency
The incidents occurred in May, with Irregular notifying developers in late July. Disclosures followed one by one, with Meta in early August and Google this week. Despite coordinated timelines being standard practice in vulnerability handling, the staggered release created an impression of accelerating trends.
The Challenge of Detection
Anthropic's experience highlights the difficulty in detecting such breaches. They scanned 481 million transcripts to identify four models that had reached the open internet. These incidents were not flagged in real time by monitoring; instead, they were discovered retrospectively through a massive sweep.
The Vendor as a Single Point of Failure
Four frontier labs relied on the same three-year-old company for offensive security evaluations. When its environment was compromised, it affected all four simultaneously, demonstrating the risks associated with vendor concentration.