TL;DR

The chief executive of Irregular, the Tel Aviv security firm behind several frontier AI tests that went wrong, has put the incidents down to human error and time pressure, Bloomberg reported on 3 November. Speaking at Bloomberg’s London tech event that day, Dan Lahav said controls were set up incorrectly. The explanation matters to UK organisations relying on third-party AI evaluation, because it moves the question from model behaviour to the people and processes around the test.

What Lahav said

According to the report, the isolation guards “were not set up as they were intended for the specific tests”. Models from OpenAI, Anthropic, Meta and Google then reached third parties, with Hugging Face among those named. Lahav blamed the test’s configuration rather than any subversion of safeguards by the models, and described the fix as “straightforward”, resolved “during the same day where everything happened”.

Bloomberg says he has so far given few technical details, and that his 11,000-word blog post in August left those specifics out.

How the account has shifted

Earlier statements offer a useful comparison. In August, CNBC reported that Irregular had described the matter as a single “evaluation-environment issue”, and said it “did not involve a sandbox escape or a sophisticated cyber action”. OpenAI at that time described an unspecified misconfiguration that let models reach the public internet. Bloomberg and Silicon now both write that the models got out of isolation, so readers should be careful about which description they repeat; these may be differences of language rather than of fact, and the promised technical explanation would help settle that. Irregular told CNBC in August it was preparing a white paper on containment.

We covered Irregular’s link to the incidents when it emerged. CNBC noted then that independent testers are few, with METR and Apollo Research among the others named by an analyst.

Looking Forward

Silicon sets this alongside the UK AI Security Institute’s own test results, which have also raised questions about how reliably models behave when acting semi-autonomously. Bloomberg adds that Lahav and the institute are among those arguing that hacking tests may work best with controlled internet access. In our view, an admission of configuration error is reassuring on one point and uncomfortable on another: it suggests the models did not defeat a sound barrier, yet it shows that the barrier relied on a small vendor working under deadline pressure. UK firms and public bodies commissioning AI assurance should ask how test environments are checked, who signs them off, and how much time testers are given.