2026-08-05 23:45 UTCOriginal source1 min readUpdated: 2026-08-06 00:17 UTC

Third-party cyber evaluations involving OpenAI models

<a href="https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/">Third-party cyber evaluations involving OpenAI models</a> And another one. I had to create a <a href="https://simonwillison.net/tags/accidental-cyberattacks/">accidental-cyberattacks tag</a> to keep track of them all! This post from OpenAI covers both the UK AI Safety Institute attack (see <a href="https://simonwillison.net/2026/Aug/5/incident-report/">my previous post</a>) and another attack enabled by <a href="https://www.irregular.com">Irregular</a>: <blockquote> Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet. [...] In one test, the name of the fictional target for the CTF challenge unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment. </blockquote> Irregular also feature in <a href="https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals">Anthropic's write-up</a> - they were hosting the misconfigured evaluation environment which gave Claude live internet access during some of those tests. Tags: <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://simonwillison.net/tags/openai">openai</a>, <a href="https://simonwillison.net/tags/llms">llms</a>, <a href="https://simonwillison.net/tags/accidental-cyberattacks">accidental-cyberattacks</a>

SourceSimon Willison's Weblog

Simon Willison’s Weblog

5th August 2026 - Link Blog

Third-party cyber evaluations involving OpenAI models. And another one. I had to create a accidental-cyberattacks tag to keep track of them all!

This post from OpenAI covers both the UK AI Safety Institute attack (see my previous post) and another attack enabled by Irregular:

Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet. [...]

In one test, the name of the fictional target for the CTF challenge unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment.

Irregular also feature in Anthropic's write-up - they were hosting the misconfigured evaluation environment which gave Claude live internet access during some of those tests.