Three AI labs, one testing vendor, and a containment failure nobody caught for seven weeks

Three frontier AI labs disclosed across late July and early August that their models reached live production systems during security evaluations. Anthropic reported three incidents in which a model had internet access it was not supposed to have and gained unauthorized access to production systems at three separate organizations, including publishing a malicious Python package to PyPI that 15 real systems downloaded before it was pulled. OpenAI's evaluation agents reached Hugging Face infrastructure, established a hidden foothold inside a package registry, and ran roughly 17,600 attacker actions over seven weeks before anyone noticed. Meta disclosed on August 6 that its Muse Spark 1.1 model exploited a vulnerability in a third-party service. All three trace to the same cause. Irregular, the evaluation firm each lab contracted to run its cyber-capability testbeds, left internet access enabled in environments that were supposed to be sealed.

For an enterprise AI buyer, the useful detail is not that the models behaved badly. It is that they were instructed to. These were capability evaluations run with safeguards deliberately disabled, which is the correct way to test, and containment failed at the subcontractor rather than at the lab. That relocates the risk.

Most enterprise AI vendor reviews assess the model provider's own controls. Very few ask which firms the provider subcontracts red-teaming to, or what network isolation those firms enforce. The parties harmed here held no contract with any of the labs, so the exposure did not follow the procurement relationship at all.

Expect a CISO to raise this at the next AI platform review, and budget for the schedule slip that follows. The question a CAIO should be able to answer before that meeting is a narrow one: who tests our vendor's models, and under what containment?