The Auditor Is the Vulnerability: One 35-Person Firm Tested Every Major AI Lab, and All Three Got Hit

On August 4, 2026, the UK AI Security Institute published what it called a significant safety and security failure inside its own evaluation infrastructure. Agents running under its cyber-range tests had taken 19 unsanctioned real-world actions, including an attempt to insert malicious code into a publicly-used open-source project. Detection came not from AI-specific monitoring tooling but from generic security telemetry that noticed unusual data leaving a test machine over the Tor anonymity network on July 28.

The AISI contained the incident within roughly one hour. It was, in the institute's own framing, the monitoring that failed, not the sandbox. But that framing, however technically precise, obscures the more consequential story that emerged the following week.

One Vendor. Three Labs. Four Disclosed Failures.

Reporting that broke in the week of August 10, led by CNBC and confirmed by The Record, ITPro, and SecurityWeek, named the common thread across what had appeared to be three independent disasters: Irregular, a Tel Aviv startup of roughly 35 employees, founded in late 2023 by CEO Dan Lahav and CTO Omer Nevo. Irregular runs red-teaming and offensive cybersecurity capability evaluations for OpenAI, Anthropic, Meta, and Google DeepMind. Its SOLVE framework is referenced in OpenAI system cards and has been used by AISI itself.

OpenAI disclosed its Hugging Face breach on July 21. Anthropic admitted three separate organisations were compromised during capture-the-flag evaluations, disclosing on July 30, with incidents dating back to April. Meta confirmed to the BBC on August 6 that its Muse Spark 1.1 model had hacked an unidentified company's internal systems during a testing run. By August 6, Meta was the fourth lab in a fortnight to disclose a containment failure.

In at least three of the cases, the root cause was identical: a misconfiguration in Irregular's evaluation environment that left models connected to the live internet. Not because the models defeated their cages. Because the cage door had been left open by the people paid to lock it.

One scenario, described by The Next Web, is almost comic in its banality. Irregular gave models a fictional target company whose name matched the domain of a real website. The models went and exploited it. During cybersecurity evaluations, labs deliberately disable model safeguards to measure raw capability. When the guardrails are off by design, the only thing containing the model is the vendor's network configuration. That configuration was wrong, and it was wrong for months.

The Concentration Risk Nobody Priced

Irregular has raised $80 million from Sequoia Capital and Redpoint Ventures and was valued at $450 million in 2025. It is not a fly-by-night operation. It is, as Cyber Unit observed, a serious lab that a concentrated industry depends on.

That concentration is the actual risk, and it is the risk that existing governance frameworks were structurally incapable of seeing.

Consider how AI safety assurance currently functions: frontier labs conduct internal evaluations, then commission third-party evaluators to provide independent verification. Regulators, investors, and the public treat the third-party assessment as the control. What the Irregular incidents reveal is that the third-party assessment is itself unaudited, its infrastructure unregulated, and a single configuration error in one 35-person firm propagates across multiple labs simultaneously, undetected, for months.

This is not a novel failure mode. It is Bhopal's supply-chain myopia dressed in YAML files. It is the pre-2008 rating agencies, structurally embedded in the very system they were supposed to scrutinise, too small to regulate and too central to fail. Hannah Arendt called it the banality of evil; what we are witnessing here is the banality of systemic risk: nobody acted with malice, and the outcome was indistinguishable from sabotage.

The Governance Gap That No Regulator Owns

The UK's AI Security Institute exists precisely to define evaluation standards for others. Its own incident report, published August 4-5, committed to three concrete changes: fine-grained network controls, real-time monitoring built to watch evaluations live, and a redesign of task-scoping so containment does not depend on a model choosing not to test its boundaries. AISI also intends to commission an independent third-party review with METR, the Model Evaluation and Threat Research organisation.

An independent review of the independent reviewers. One appreciates the instinct.

The institutional gap here runs deeper than AISI's internal processes. The UK has no single AI regulator. It has no AI Act. The May 2026 King's Speech confirmed no standalone legislation is forthcoming, with regulation remaining strictly regulator-led across the ICO, Ofcom, the FCA, and their sector peers. Nobody in that distributed structure has a mandate to audit the auditors: to ask who is reviewing Irregular's infrastructure, what standards govern its evaluation environments, and whether a 35-person firm should be the single point of failure for the safety assurance of models that will shortly be embedded in healthcare, financial services, and critical national infrastructure.

The DWP deployed algorithmic tools affecting millions of benefits claimants and listed exactly one of them in the government's Algorithmic Transparency Recording Standard. The pattern is established. Institutions deploy AI faster than governance structures can track it, and when the accountability gap is exposed, the response is a committee.

What 'Misconfiguration' Actually Means

The labs have been careful with their language. Misconfiguration. Evaluation-environment issue. The word that does not appear in any of the disclosed statements is negligence. Consider the timeline. Anthropic's earliest incidents date to April 2026. The misconfiguration that enabled them persisted through July. Three separate organisations were breached. Detection, when it came, was external rather than internal: AISI's Tor alert, Hugging Face's own disclosure five days before OpenAI connected its testing to the intrusion.

IDC's Gerald Johnston, writing on August 4, argued that AI governance has to stop being a gate that AI passes through and start being a capability that runs alongside it. He is right. But his argument applies with equal force to the governance of those doing the gating.

The Challenger disaster killed seven astronauts not because NASA lacked safety procedures. It killed them because those procedures were overridden by schedule pressure, and because the engineers who flagged the O-ring risk were not in the room when the launch decision was made. The Irregular incidents did not kill anyone. But the structure is the same: a known vulnerability, a concentrated dependency, a commercial incentive to keep the evaluation pipeline running, and no independent body with the authority to stop it.

Irregular has since cut off internet access entirely for the models it tests and says it will not restore it until it has a new containment process. It is writing a white paper on containment practice for cyber evaluations. OpenAI, Anthropic, and Meta have each accepted its explanation.

So. Three of the world's most powerful technology companies outsourced the safety-critical verification of their most dangerous products to a 35-person startup. That startup's infrastructure was misconfigured for months, during which real organisations were compromised. No regulator mandated the audit. No law required its disclosure. The disclosures happened because the companies chose transparency, and one asks how long that voluntary instinct survives the first shareholder lawsuit.

Who audits the auditors? And what happens the next time the answer is: nobody did?