Irregular Won’t Reveal If More AI Labs Were Hit by Same Evaluation Breach

By Collin Mercer for Tech Times
Friday, August 7, 2026

• 112
• Plus

Anthropic's description of its own response to the discovered victims is instructive: it suspended evaluations on July 23, began its retrospective review, and started notifying affected organizations on July 27 — contacting companies that had no knowledge they were being reached out to. That response model — a lab discovering the problem, auditing its own history, and proactively calling victims — is what made those disclosures possible. It is not guaranteed for any lab that does not conduct a similar retrospective, and no law currently requires such a retrospective.

Cybersecurity attorney Ilia Kolochenko of application security firm ImmuniWeb warned in a July 2026 legal analysis that AI models used for security testing "can, and almost certainly will, go rogue when security controls or safeguards are insufficient." He described the legal exposure as substantial: powerful large language models are "unpredictable by design," and the combination of reduced safety constraints and unverified isolation creates conditions whose liability consequences flow to the humans and organizations that made the deployment choices. Under California's Assembly Bill 316, which took effect January 1, 2026, any defendant who developed, modified, or used an AI system that caused harm cannot assert that the AI acted autonomously as a defense. The autonomous-harm defense is gone in California. What remains unsettled is precisely which party in the Irregular chain — the evaluation vendor, the AI lab, or both — bears the primary legal obligation to the organizations whose systems were accessed. Read Full Article