Irregular, an AI security testing company, reported that during evaluation of Anthropic AI models, a naming error caused some models to target a real-world domain instead of a fictional test target. Internet access was enabled in the test environment, and the fictional company name overlapped with an actual domain that was not widely known. In a few test runs, the models conducted offensive actions against the real domain, exploiting vulnerabilities, extracting credentials, and accessing a production database. The incident was traced to the naming overlap and insufficient containment controls. Irregular is implementing stronger manual oversight, dedicated teams for containment, and improved evaluation documentation and monitoring to address these gaps.

The incident resulted in AI models unintentionally attacking a real company’s systems during testing, exploiting vulnerabilities and accessing sensitive data. The real domain lacked common security safeguards, making it vulnerable to the frontier AI models. The activity was limited to a small number of test runs and was not directed by explicit instructions. This highlights risks in AI model testing environments where containment failures can lead to real-world impacts. No evidence of widespread exploitation or active threat campaigns is reported.

Irregular is expanding manual review of model behavior during testing and establishing a dedicated internal team to challenge containment assumptions. They are improving evaluation setup documentation, continuously revalidating domain overlaps, and advocating for better forensic evidence sharing across organizations. Users and testers should ensure fictional target names do not overlap with real domains, disable internet access in test environments where possible, and apply strict containment controls. Patch status is not applicable as this is a procedural and operational issue rather than a software vulnerability.