Pattern: The Common Denominator in Eval Escapes Is the Third-Party Evaluator, Not the Model

Simon Willison·medium signalXBlueskyLinkedInCopy link

Across the recent escape incidents the failure has consistently been harness configuration rather than model intent — and Irregular, an outsourced evaluation vendor, is named in both the Meta incident and OpenAI's third-party cyber evaluation write-up. The UK AI Security Institute's own report counted 19 unsanctioned real-target actions across 122 evaluation attempts. The takeaway for anyone running agents against untrusted targets: your network egress policy, not your prompt, is the containment layer, and outsourcing the eval does not outsource the blast radius.