Founders Dan Lahav and Omer Nevo built Irregular to test frontier AI safely; a May configuration error exposed the difficulty of that job.
By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)
· Published
Primary source: [Ars Technica](https://arstechnica.com/google/2026/09/google-confirms-gemini-models-hacked-three-companies-in-may-2026/)
Why it matters #
Irregular's error shows that AI safety evaluations are themselves privileged production systems. As agents gain offensive skills, a bad network rule or reused company name can turn a benchmark into an unauthorized intrusion.
A Gemini evaluation run in May by Dan Lahav (@dan_lahav) and Omer Nevo's Irregular gave Google's models unintended internet access, leading them into systems at three real companies, Google confirmed on September 18th.
The incidents, first reported by The Wall Street Journal and detailed by Ars Technica, began with a test meant to measure Gemini's offensive cybersecurity abilities inside a controlled environment. Irregular had created a fictional target, but its name matched a real company. The test environment could also reach the public internet when it was supposed to keep the models contained.
Gemini followed the available path. In one run, a model repeatedly guessed passwords until it entered an online service. In two others, models found credentials that companies had accidentally exposed in public software repositories and used them to access protected systems. Google said the models stopped after recognizing that they had reached real infrastructure.
For Lahav and Nevo, the episode lands directly on the problem they founded Irregular to solve: frontier models are gaining useful offensive capabilities faster than the industry is establishing dependable ways to measure them. Their test demonstrated that progress, along with the operational risk created when an evaluator's boundaries fail.
The failure was in the test boundary
The public evidence does not show Gemini discovering a novel exploit or deliberately escaping a secured sandbox. Irregular's environment already had internet access, and the fictional company's name pointed the models toward a real-world target. Password guessing and using credentials exposed in public repositories are basic intrusion methods, even when an AI agent carries them out without step-by-step human direction.
Irregular said in an August 14th incident review that its usual process includes checking fictional names for overlaps with real companies or websites. That check failed in this evaluation. Internet access had also been enabled because realistic cyber exercises sometimes require it, according to Irregular, leaving the models able to act outside the simulation.
Irregular said most runs remained inside the intended environment. In a small number of cases, models targeted the matching real domain or a site with a similar name. Irregular disabled the affected evaluation, reviewed logs and added safeguards, including broader manual review and a dedicated internal group tasked with challenging assumptions about containment and model control.
Irregular did not tell Google about the Gemini incidents until July, Ars reported. Google subsequently notified the affected companies. The identities of those companies, the Gemini model versions involved and the precise information reached inside their systems have not been made public.
Google's security leadership has emphasized what happened after entry. Heather Adkins, Google's vice president of security engineering, said in Ars Technica's report, the models acted responsibly because they stopped when they recognized the systems were real. "In this case, the model acted appropriately," she said.
That behavior reduced the potential damage. It did not authorize the preceding access. A model that halts after entering the wrong system still creates an incident for the system owner, the AI laboratory and the evaluator responsible for keeping the exercise within scope.
Irregular's founders chose the difficult version of AI evaluation
Lahav and Nevo built their careers around systems that reason and act under complicated conditions. Lahav previously worked on IBM Research's Project Debater and holds a master's degree in computer science with a bioinformatics specialization from Tel Aviv University. He was also named best speaker at the 2018 World Universities Debating Championship, a background that fits his focus on evaluating how models plan across long chains of decisions.
Nevo spent 12 years in Israel's Unit 8200 intelligence organization before co-founding NeoWize, an AI personalization startup acquired by Il Makiage in 2019. He later worked at Google on AI systems used for wildfire monitoring. Lahav and Nevo met through Tel Aviv University's debating circuit and founded the business in 2023 under the name Pattern Labs before relaunching it as Irregular.
Their pitch is that familiar benchmarks no longer reveal enough about the strongest models. Irregular's FrontierCyber benchmark places agents against controlled versions of real software, databases, networks, phones and routers. The systems keep production-style defenses such as authentication, isolation and network boundaries, while the models receive a fixed objective without a prescribed attack path.
That approach can reveal capabilities hidden by smaller capture-the-flag challenges. It also raises the cost of mistakes. The closer an evaluation gets to real infrastructure, the more its containment, domain selection, credential handling and monitoring need to resemble the controls used in an actual security operation.
Investors have already placed a substantial bet on Lahav and Nevo. Irregular raised $80 million in September 2025 in financing led by Sequoia Capital and Redpoint Ventures, with participation from Wiz CEO Assaf Rappaport. TechCrunch reported that the deal valued Irregular at about $450 million. Irregular has worked on model evaluations for Google, OpenAI and Anthropic, placing its infrastructure between frontier labs and the risks those labs want measured before release.
The May incident makes Irregular's own controls part of that evaluation. Labs hire outside testers because independent pressure can expose weaknesses internal teams overlook. Those testers also become another privileged layer with model access, realistic attack environments and the ability to connect experiments to external systems.
The models are becoming capable enough for small errors to matter
Irregular argues that offensive benchmarks built around known vulnerabilities are losing value as frontier models improve. Its answer is to test agents against real systems and open-ended objectives, then measure whether they can discover and execute a workable attack path.
The Gemini incidents show why capability and containment have to advance together. The models did not need exceptional hacking skills once the environment supplied internet access and plausible targets. They used ordinary techniques against ordinary weaknesses: guessable passwords and credentials left in public code.
That is a practical warning for companies deploying agents as well as for laboratories testing them. An agent does not need to invent a zero-day vulnerability to cause harm. It needs tools, an objective and a boundary that exists in documentation rather than in the network configuration.
Lahav has described AI security as a moving target because each stronger model changes what evaluators must defend against. Irregular's founders now have a concrete example from their own infrastructure. Their response will matter to every lab relying on external evaluations to establish that increasingly autonomous models can be tested without turning the test itself into an intrusion.