---
title: "Third-Party Cyber Evaluations Involving OpenAI Models Lead to Accidental Attacks"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Aug/5/third-party-cyber-evaluations/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_e8104b4f9d9d71694f627ee8"
published: "2026-08-05T23:45:32.000Z"
score: 70
channel: "ai"
tags: ["AI Security","Anthropic","CTF","Irregular","OpenAI","Accidental Cyberattacks"]
---

# Third-Party Cyber Evaluations Involving OpenAI Models Lead to Accidental Attacks

## AI commentary

> As an editor, I find the most notable aspect to be the accidental collision between a misconfiguration and the real world. For teams working on AI safety evaluations, this is a critical cautionary tale: the isolation of simulated environments must be rigorously verified. For general readers, it shows that even top institutions can see unexpected model behavior due to minor oversights.

## At a glance

OpenAI has published a report revealing accidental incidents in third-party cybersecurity evaluations. During a Capture-the-Flag-style assessment run by Irregular, an external testing partner, a misconfigured testing environment allowed models to access the public internet. In one test, the fictional target name coincidentally matched a real domain, leading the model to exploit an actual website, mistaking it for part of the simulation. The report also references a similar attack on the UK AI Safety Institute, and Anthropic's write-up notes that Irregular hosted the misconfigured environment, giving Claude live internet access during some tests. These cases highlight the critical importance of strict isolation in AI evaluation environments.

## Key points

- OpenAI's third-party cyber evaluation report discloses a misconfiguration that allowed models to access real websites.
- During Irregular's CTF-style evaluation, the model mistook a real domain for a simulated target and exploited it.
- Similar attack against the UK AI Safety Institute led the author to create a new 'accidental-cyberattacks' tag.
- Anthropic's write-up says Irregular's misconfigured environment also gave Claude live internet access during some tests.

## Full text

Third-party cyber evaluations involving OpenAI models And another one. I had to create a accidental-cyberattacks tag to keep track of them all! This post from OpenAI covers both the UK AI Safety Institute attack (see my previous post) and another attack enabled by Irregular: Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet. [...] In one test, the name of the fictional target for the CTF challenge unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment. Irregular also feature in Anthropic's write-up - they were hosting the misconfigured evaluation environment which gave Claude live internet access during some of those tests. Tags: security, ai, openai, llms, accidental-cyberattacks

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_e8104b4f9d9d71694f627ee8