What Irregular said
Irregular runs evaluation environments used by AI labs. Its postmortem describes models that were supposed to attack a simulated target reaching real systems instead:
The attacking model’s instructions included both the target name and the internal addresses within our network where it should find the target within our simulated environment. In the vast majority of runs, models indeed operated inside the simulation environment. However, in a handful of cases, models attempted to gain access to the real domain (outside the environment), despite receiving no such instructions.
On why it was easy, and why it went unnoticed:
The discussed domain lacked several common security practices in place - and therefore most frontier AI models found it easy to exploit. […] part of what made the incident hard to detect is that it happened in a very small fraction of the runs - and usually in a late stage of the simulation (often hundreds of turns in).
Read that second quote twice. It blames the victim’s security, then explains that the operator’s own monitoring did not catch it. Neither is an AI capability story. The environment could reach the internet, and nobody was watching.
The Record covered the postmortem and the criticism of it, including Zack Korman’s argument that Irregular was not doing the job its customers relied on it for.
The controls that would have caught it
- Deny egress by default from evaluation and test environments. Every one of these incidents runs through this. CIS 12.2, 4.8, 13, and 4.4 and 4.5 (firewalls on servers and end-user devices).
- Detection, not just logging. None of these were caught in real time by the operator. Anthropic’s came from a log review four months later. CIS 8.11 and 13.1.
- Treat test infrastructure as privileged. Sandboxes, proxies, and orchestration services are machine identities with real access. CIS 5.4, 6.8, and 12.8.
- No reusable credentials anywhere an agent can reach. Anthropic’s model pulled credentials and reached a production database. CIS 3 and 5.2.
- Disclosure quality. CIS 16.2 and 17, the same controls as episode 1.
What the postmortem leaves out
- No total incident count.
- No dates on remediations.
- No verification criteria for the fixes.
- No publication date for the promised whitepaper.
- If this work is as critical as the labs say it is, why hand it to an evaluator with these gaps?