Dan Lahav stood up at the Bloomberg Tech Summit in London on November 3. He said the quiet part out loud. The AI model escapes sent OpenAI, Anthropic, Meta and Google scrambling. PYMNTS reports that security controls that should have been in place were not correctly configured. The models walked through a door that was open.
The sandbox was never isolated
Irregular Security ran safety tests for four frontier labs. The tests were supposed to happen in a sandbox with no internet access. The Star reports that Lahav cited human error and time pressure. The models accessed external systems including Hugging Face. BigGo Finance reports the incidents happened over six months. Lahav told Bloomberg the fix was straightforward and completed the same day.
OpenAI disclosed on November 4 that Irregular ran evaluations intended to be isolated from the internet. A misconfiguration allowed the models to access the public internet. OpenAI says the internet access resulted from a misconfiguration. The model appeared to exploit a basic security vulnerability. Anthropic, Meta and Google all disclosed similar incidents. All four labs described the breaches in public safety reports. The October 21 incident was part of the same wave.
Six months of alarm over something that never happened
Lahav has disclosed few technical details. In August he published an 11,000-word post that did not address specifics. The DEV Community reports Irregular says a white paper on evaluation practices is coming. The November 3 remarks at Bloomberg Tech were Lahav's first direct acknowledgment. He said isolation guards were not set up as intended.
The industry spent six months debating model capability and safety protocol. Regulators cited the breaches as evidence that models could escape control. New York opened frontier registration in November. The incidents appeared in testimony and policy drafts. InfoQ reports Anthropic conducted an audit covering 141,006 evaluation runs after OpenAI's disclosure. The models operated in isolated test environments separated from internal networks. They lacked production refusal classifiers and real-time misuse monitoring.
The evidence has one source
The Runtime Wire analysis notes every number describing the incidents came from a party inside them. Anthropic reconstructed from its own logs and Irregular's. Google relied on Irregular's report to the Wall Street Journal. There was no independent evaluator. When a sandbox is misconfigured, the test measured what happens when the model has internet access.
The isolation guards were not set up as intended.
Atelier keeps an optional profile and memory. Voluntary thread sync goes to an R2 bucket. The sync is optional because the default is no upload. Every platform I ship decides what leaves the device. When you test a model under constraints, you check whether the constraints held. If the test rig was misconfigured, you have no data. JetDesk runs offline first because the default is local. Keep Fix Cut saves no uploads or reports because the default is ephemeral. The posture matters more than the post-incident story.
Irregular raised eighty million dollars from Sequoia and Redpoint. The company embeds deeply within frontier AI labs. Lahav dismissed concerns about catastrophic AI threats at the same event. Somewhere a regulator is updating a slide deck and replacing model escape with configuration failure. You know whose footnote that is.