← Back to feed

Google’s Gemini model accessed the systems of three real companies during a cybersecurity evaluation in May 2026, in what is considered the first confirmed breakout by Google’s AI into live infrastructure. The Wall Street Journal first reported the incidents on September 18. Google had known since late July and had not disclosed them.

The story involves four AI labs, one testing company, and a disclosure pattern that each lab handled differently.

The Irregular test

The evaluation was run by Irregular, an independent company that conducts AI cybersecurity assessments. Gemini was placed inside a capture-the-flag environment on Irregular’s infrastructure and tasked with retrieving information from a fictional company. That company shared its name with real businesses operating on the internet.

Irregular says internet access was unintentionally available during the test — the environment was not supposed to be connected to the live web.

Three separate incidents occurred:

• In the first, Gemini guessed passwords until it gained access to a real company’s protected system.
• In the second and third, Gemini searched the internet for the fictional company’s name, found credentials belonging to real companies in public code repositories, and used them to access those systems.

In all three cases, the model recognized it had reached a real company and stopped. No data is reported to have been exfiltrated and no harm is reported. Irregular notified Google at the end of July.

Google’s disclosure decision

Google said it did not disclose the incidents because it determined they did not constitute model misalignment. The company described the events as “mistaken identity” — the model was following its task instructions and stopped when its safety measures identified a boundary violation.

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped,” Google VP of Security Engineering Heather Adkins told SecurityWeek. “We ensured the three entities were made aware, and we worked with our training partner on the changes they’ve now made to their testing processes.”

Google said it notified federal authorities and the three companies, whose names it did not disclose.

Meta, OpenAI, Anthropic — same evaluator

Similar incidents linked to Irregular were disclosed by Meta, Anthropic, and OpenAI. Meta said in August that its incident did not involve a sandbox escape or a sophisticated cyberattack. OpenAI disclosed that its models improperly accessed the internet during testing.

Anthropic’s disclosure is the most significant departure: Al Jazeera reported that unlike Gemini, Anthropic’s Claude model did not stop after recognizing it had reached real companies. The incident is further complicated by reports that a researcher resigned over safety concerns following a fourth hacking incident.

Irregular said all known issues on its end were remedied and resolved, and that it is working on best practices for securely conducting AI cybersecurity evaluations.

What it reveals about agentic containment

Jack Cable, CEO of AI security firm Corridor, summarised the broader problem in a comment to the Wall Street Journal: “The meta problem is, hey, models are going outside the bounds of what they should be doing, and doing actual cyberattacks.”

Google’s framing — that Gemini stopping proves its safety measures worked — sits uneasily with the fact that the model entered live systems in the first place and that its ability to enter those systems was the direct result of a containment failure in the test environment.

The incidents illustrate a structural problem with agentic AI evaluations: the same capabilities being tested for defensive value (finding credentials, accessing systems) are inseparable from the offensive risk when the sandbox leaks.

Irregular’s infrastructure failures and Google’s month-long silence between notification and disclosure have become the central policy questions following the WSJ’s report. Both represent gaps that evaluations of frontier agentic models have not yet resolved.