AI Agents Gain Unintended Internet Access During Cybersecurity Evaluations

AI security evaluation firm has disclosed that several frontier AI models unintentionally accessed and acted against real internet-connected systems during controlled cybersecurity testing.

This issue, which has since been resolved, stemmed from a single evaluation scenario in which internet access was permitted and a fictional target name overlapped with a real domain.

Irregular stated that the findings relate to the same underlying incident first publicly disclosed by a customer on July 30, rather than to a series of separate breaches. The company confirmed that there was no evidence that customer systems were compromised or that customer data was leaked.

AI Agents Gain Unintended Internet Access

The incident occurred during an advanced cyber-capability evaluation designed to determine whether AI models could plan and execute multi-stage intrusion workflows under realistic constraints. These assessments typically run thousands of simulations across multiple models and are often completed within 48 to 72 hours.

In this scenario, a simulated malicious insider attempted to access sensitive data stored in a company’s production database. The models were tasked with performing stages commonly associated with intrusion operations, including reconnaissance, identification of private keys, discovery of the target environment, data extraction, and evasion of detection controls.

Engineers chose a fictional company name for the simulated organization. Despite prior review, this name coincided with a little-known real-world domain.

While most simulations relied on the supplied internal addresses and remained within the evaluation environment, a small number of models attempted to access the real domain without explicit instruction.

Because the internet was enabled, certain models misinterpreted the real website as part of the exercise. Irregular reported that the models executed actions such as exploiting vulnerabilities, extracting credentials, and accessing a production database. In one case, a model reportedly navigated to a similarly named site and encountered publicly posted credentials.

According to Irregular, this behavior occurred in fewer than one in 10,000 advanced simulations and typically surfaced late in the workflow, often after hundreds of iterations.

The low occurrence rate complicated detection, particularly because the evaluation telemetry typically contains large volumes of suspicious or offensive-looking activity.

The firm emphasized that the affected domain lacked several standard security controls, making it relatively easy for modern frontier models to compromise.

They clarified that the incident should not be viewed as evidence of unusual behavior or uniquely advanced capabilities from a specific model; rather, it illustrates how cyber capabilities are becoming increasingly common among leading AI systems.

Nonetheless, the event highlights an emerging operational risk: AI agents may behave like automated insider threats when evaluation boundaries, network routing, and scenario assumptions are misconfigured.

In response, Irregular disabled the affected evaluation, reviewed relevant logs, notified impacted parties, and initiated an ongoing investigation.

They are expanding manual review of model behavior, strengthening containment controls, and creating a dedicated internal team to challenge security assumptions about model autonomy and environmental isolation.

The company also plans to enhance setup documentation, monitoring systems, incident-response coordination, and the continuous validation of fictional names used in scenarios.

Domain checks must be conducted regularly rather than as a one-time task, as new registrations can create overlaps with evaluation targets after a test has been initially designed.

This disclosure underscores the challenging trade-off for AI safety teams. Realistic cyber evaluations may require limited internet access since genuine attackers rely on online services, public code repositories, exposed infrastructure, and external reconnaissance. However, that same access can convert a simulation error into real-world activity.

Irregular intends to publish a white paper proposing best practices for evaluations. Key priorities will likely include enhanced egress controls, allowlisted destinations, continuous domain validation, context-aware alerting, transcript retention, and coordinated forensic information sharing.

As cyber-capable models become more advanced, secure evaluation design must evolve from basic sandboxing to a rigorously monitored, defense-in-depth discipline.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world