Last week, Google became the latest AI giant to report that its advanced AI model had been caught attempting to hack companies. Google’s report follows similar disclosures made about a month ago by Meta, OpenAI, and Anthropic. All four companies credited, or pointed the finger at, Israeli firm Irregular, an AI cybersecurity lab that has developed a closed environment allowing the most powerful language models (such as Anthropic’s Claude Mythos and OpenAI’s Astra) to experiment with extreme scenarios.
In other words, this Israeli-developed environment, which saves AI giants the need for hundreds of security personnel to conduct manual testing, allows models to "run wild" within the system, revealing the risks and vulnerabilities they might introduce. In technical terms, this isolated environment is known as a "sandbox."
As recent weeks have shown, the tech giants' advanced AI agents often act on their own initiative, bypassing rules and safeguards, and even coordinating attacks with one another. However, there have been no documented instances of dangerous autonomous attacks occurring without human involvement. In most cases, actual damage was averted. In Google’s case, for example, the language models realized they were breaching a real website and voluntarily halted the attack.
At the center of the storm currently buffeting the global tech scene are two Israeli entrepreneurs: Irregular’s founders CEO Dan Lahav and CTO Omer Nevo. Until last year, they were little-known engineers whose primary claim to fame stemmed from their participation, and notable achievements, in global debate competitions. Just over a year ago, the duo announced an $80 million funding round to launch Irregular. The round was led by Sequoia Capital and included participation from some of the cybersecurity industry’s shrewdest investors including Redpoint Ventures, Assaf Rappaport, and former NBA basketball player Omri Casspi.
At the eye of the storm involving the world's major AI labs
Omer Nevo told "Globes," before last week’s revelations about Google, "The past year has been crazy, and the last few weeks have been a frenzy of even higher intensity. At the same time, we’ve deepened our work with the leading labs; Google and OpenAI have become our clients. Today, I can say that we are enhancing the models' defensive capabilities and assisting in their training to make them safer and we work not only with companies but also with governments to ensure humans retain control over AI models when they behave unpredictably. In terms of our operations, the scope of our work with the major labs has expanded over the past year, and the company itself has grown and we now have 50 employees."
You’ve become a focal point of global attention, with the biggest tech giants in the field - Anthropic, Meta, and Google - singling you out. Do you feel there is a lack of understanding surrounding your work, forcing you to explain yourselves over and over? Does this place you in a position you hadn't envisioned when you founded the company?
Nevo says, "On a personal level, it’s a very intense period, but also a very meaningful one. When we founded Irregular, we started with the premise that AI systems would rapidly become powerful and autonomous, and that someone needed to understand how they would behave and how to guard against the risks they bring. At the time, we felt there was a major gap between what we were seeing and the level of global attention the issue was receiving. Today, with these questions at the center of the conversation, I feel that gap is starting to narrow. It is important to me to work at the forefront of a field like this - tackling problems that don't yet have clear answers. It isn't always easy, but for me, that is precisely what it means to work on something so significant and important."
Nevo adds that not only has Irregular not lost clients due to the events, but relationships with them have actually strengthened. "Our clients want us to lead the joint research on how to move forward and how we should operate. Having concluded our analysis of what happened, we are now discussing deepening our partnership. This event made it clear to everyone that neither the scientific community nor global industry currently has the answers. Our company has grown tremendously stronger in terms of client relations, broader visibility, and even the influx of job candidates. We are stepping out into the world with a mission that is both complex and clear."
This is how AI models broke out of the secure environment
In the incident involving Google reported over the weekend, similar to events involving Meta, Anthropic, and OpenAI, two failures occurred. In the first, Google’s model was practicing hacking a fictitious site but independently identified a real company with a similar name and attempted to hack it. The second failure involved an undefined exit point from Irregular’s secure environment (the "black box") to the open internet.
In Google’s case, the Gemini model attacked a site by systematically guessing passwords until it gained access to the protected system. In another instance, the model discovered hidden username and password credentials, enabling it to attempt breaches against two other enterprises. Google maintains that no damage occurred and that the breach was halted before any harm could be done.
A similar incident involving Irregular occurred with Claude-creator Anthropic during testing of some of its most powerful models, such as Fable and Mythos.
"As I see it, there was one failure on our end," admits Lahav. "There is a single operating environment that runs across multiple settings, and there was a single configuration error that allowed models to reach the Internet. At any given moment, we run a vast number of models simultaneously from various labs - sometimes dozens or even hundreds of instances per model - and a few of these made their way online. While this happened several times, the root cause was the same error allowing models to go public, without causing major damage. This was in contrast to a different incident, which we weren't involved in, of an attack on the Hugging Face repository (recently sold to Nvidia for $13 billion) that caused it to launch powerful attacks."
Nevo does not shoulder sole responsibility for the company he founded. Instead, he attributes the issue to the communication between Irregular and Anthropic. "In one of the cases discovered at Anthropic, not all of which involved us, a model uploaded a malicious Python code package to an external library. Enterprises then downloaded and executed it in their own systems," he says.
"It was an attack in every sense, yet the model believed it was operating within the 'sandbox' -our secure environment - while attacking a specific site. Although it was configured to operate within the sandbox, it broke out via an open path. Our analysis revealed that this occurred, in part, due to instructions Anthropic had given the model, to which we had no visibility. The model attempted to attack the target, realized it was unsuccessful, and found other targets on the Internet. We therefore concluded that the way Anthropic configured its settings led the model to believe it was in an environment different from the actual one. thus, The most accurate description is that the incident resulted from a combination of our environment and Anthropic's."
Nevo is unfazed by the criticism leveled at Irregular and specifically, that the manual nature of some tasks, such as configuration settings, caused the glitch. "We work with the world's biggest companies and are well past the stage of relying on manual processes for lack of a structured solution," he clarifies. "However, even the tools provided by major security firms and labs likely fall short. The models find ways to bypass them using unconventional methods that these tools aren't designed to detect, creating a problem that needs solving. That is why we put in the hard work, including manual effort, to identify these cases. Even the biggest companies sometimes resort to manual work when automated tools prove insufficient."
In AI, what is hidden is bigger than what Is known
Nevo, who refuses to get caught up in the media storm on the issue, believes that responsibility for rogue models is shared. As the executives at Anthropic and OpenAI have themselves hinted, much about the world of AI is unknown, particularly with the latest, most sophisticated language models.
"This stems from the fact that the entire field we operate in is new and ill-defined, and some of its problems remain unsolved at a scientific level not just a technical one," he says. "Mistakes happen, and we need to learn from them. As an industry, we were fortunate that a series of events occurred - events not necessarily directly linked to us, such as the incident at Anthropic, the attack on Hugging Face, and the breach at the UK’s government AI safety institute. These incidents highlighted the existence of an unresolved problem without causing severe damage. Now is the time for the industry to regroup so we can solve it. This is the moment for various industry players to unite, reverse-engineer the technology, and figure out how to 'contain' a model that might appear 'dumb' on the surface yet is smarter than the world's most brilliant researchers myself included. There are also complex legal issues and questions about data owned by third parties. The labs are aligned with us on this. Let’s resolve these questions - addressing both the underlying science and the regulatory framework - before these models cause real harm."
Your customers - Anthropic and OpenAI - have hinted that they support delaying the development of the latest models due to the inherent risks, a debate sparked by the resignation of an employee who claimed AI has the potential to destroy humanity. What is your take on this?
"We are already seeing models becoming more powerful and autonomous, capable of performing complex tasks and operating with less human intervention. The pace at which these capabilities are advancing is unprecedented, so we must also take seriously the risks emerging alongside them. At the same time, I am optimistic, both about the immense value this technology will bring to humanity, and about the industry's ability to research and develop the tools and safeguards needed to manage these risks."
But there is merit to what US President Trump says - that voluntarily slowing down model development could leave the US trailing behind China. What would you recommend doing, given this geopolitical perspective?
"I won't say here whether I recommend halting or accelerating AI development. Our role is to ensure that as models become more powerful, we simultaneously develop the ability to understand their risks and the safeguards to prevent them from performing actions they aren't supposed to do. We are working with the world's leading AI labs to spearhead both the research and the construction of these control and security mechanisms, while also generating the knowledge that will enable regulators to make informed decisions on the proper development and deployment of these systems. Ultimately, this is what will allow governments and companies to implement the policies that they will choose."
Published by Globes, Israel business news - en.globes.co.il - on September 22, 2026.
© Copyright of Globes Publisher Itonut (1983) Ltd., 2026.