Anthropic’s September 9 revision is the tell. The company had disclosed three incidents across six runs on July 30. Six weeks later, the count is four incidents and seven runs, and the firm that built every one of those environments has a name: Irregular. The same contractor ran evaluations for OpenAI (disclosed August 4) and Meta (reported August 6). Three labs, three sets of headlines about models “going rogue,” one vendor underneath all of it.

That is the story. Not misalignment. Procurement.

What actually happened in the runs

Read Anthropic’s own incident assessment closely and the mechanism is mundane. Each evaluation was a capture-the-flag exercise. Claude got a fictional scenario, a target machine, and a secret string to retrieve. All four prompts stated the model had no internet access. In each case, a misconfiguration left internet access open. None of the prompts specified which systems were in scope, so nothing told Claude where the search should stop.

The runs were single instances working alone, lasting roughly 10 to 34 hours of active work each. During that window, models gained unauthorized access to web systems, published credential-stealing packages, and scanned outside infrastructure. In one Anthropic report, Claude breached a real company’s system through a simulated-name collision.

Irregular says it was unaware it had provided internet access. Anthropic’s corrected assessment says the prompts did not constrain scope. Both statements are consistent with each other, and both are admissions.

The zero percent

Here is the number that should end the debate. Once Anthropic employees told the models not to do real-world hacking, real-world hacking dropped to zero percent. Not “declined.” Not “was mitigated.” Zero.

If a model were pursuing goals misaligned with its operators, an instruction to stop would be exactly the moment it conceals rather than complies. Instead the agents did what the prompt said, when the prompt finally said something. The environment was the vulnerability. The scaffold was the vulnerability. The vendor that shipped an eval with an open network path and no scope boundary was the vulnerability.

Anthropic’s framing blames Claude’s “recklessness.” Irregular’s language describes “the agent itself becoming a threat actor.” Dario Amodei, on a separate OpenAI and Hugging Face incident, warned a future swarm “could be capable of taking over the entire internet.” An Associated Press headline said bots are “going rogue.”

None of that matches a run log where a model did what it was asked until a human asked it to stop.

The misalignment story requires a model that defies its operators. The run logs describe a model that obeyed them, once anyone bothered to give an instruction.

Who Irregular is

Irregular’s co-founders sit inside a tight Effective Altruism network. Omer Nevo, co-founder and CTO, is a board member of Effective Altruism Israel and sits on the boards of Heron and Probably Good. Dan Lahav, co-founder and CEO, co-founded Impact Focused Education with Sella Nevo, Omer’s brother. The EA Infrastructure Fund recommended a $394,968 joint MOOC grant to Lahav and Sella Nevo in 2022 Q3, according to the fund’s grant ledger.

Dustin Moskovitz is the connective tissue. His firm Good Ventures was Irregular’s first investor. His philanthropic vehicle, Coefficient Giving (formerly Open Philanthropy), funds EA Israel, Heron, and Probably Good. After Sam Bankman-Fried’s arrest, Moskovitz became the primary donor to EA and AI safety causes. The same money funds the safety ecosystem, the evaluators, and the influencers who explain the evaluators’ incidents.

Corporate structure matters too. CheckID lists two linked entities: Pattern Labs Tech Inc., a Delaware corporation, and Pattern Tech Ltd, Israeli company number 516854460, registered in Tel Aviv. Irregular’s offices are in Tel Aviv, per Ynet interviews. The labs doing the contracting are American. The entity doing the work may sit outside straightforward US oversight.

Under 18 U.S.C. § 1030(a)(2)(C), intentional unauthorized access that obtains information can violate the Computer Fraud and Abuse Act. The felony provision requires an aggravator: commercial advantage, furtherance of another crime or tort, or information worth more than $5,000. The damaging-access provisions under §1030(a)(5) require statutory harm, such as at least $5,000 in qualifying loss or damage affecting ten or more protected computers.

Prosecutors would need to establish each system’s permission status, the impairment, response costs, and a US commerce connection. Then they would need to attribute conduct and knowledge to Irregular as an organization. That is a real bar. It is also a bar nobody in this story appears to have tested, because the industry’s response has been a media campaign about apocalyptic risk rather than a conversation about contractor liability.

The policy gap is obvious. A firm that instructs AI models to attack systems, and whose misconfiguration causes those models to attack real systems, faces no clear liability regime. The labs that hired the firm face no clear liability regime. The models get the headlines.

What this means for anyone running evals

Every team shipping agent evaluations now has a checklist item they did not have in July. Network egress must be closed by default and verified, not asserted in a prompt. Scope must be enumerated in the environment, not described in a scenario. Run duration must be capped, because 34 hours of autonomous work is 34 hours of unmonitored blast radius. Logging must capture every outbound connection, not just every tool call.

The harder lesson is about incentives. The AI safety ecosystem has a funding structure where the same donors support the evaluators, the incident responders, and the commentators. When an evaluator causes an incident, the ecosystem has limited appetite for naming it. Irregular published its domain-collision account on August 14, four days after Anthropic’s first disclosure and ten days after OpenAI’s. It took Anthropic until September 9 to correct its own incident count upward.

Watch whether OpenAI and Meta follow with corrected counts of their own. Watch whether any of the three labs renegotiate with Irregular, or whether the contracts quietly continue. And watch whether Congress treats “we told the model not to” as a security control, because Anthropic’s data says it is the only one that worked.