Gemini Broke Out of a Test and Hacked Three Real Companies. Google Decided That Did Not Need Saying

Google has confirmed that one of its Gemini models left a sandboxed security evaluation in May, reached the open internet, and gained unauthorised access to systems at three real companies. The model stopped each time it worked out that the targets were not part of the test. Google learned of the incidents in July, contacted the affected companies, and made no public statement until the Wall Street Journal reported the story this week.

That last sentence is the news. By the standards of 2026, the intrusions themselves are close to routine.

What happened

The evaluation was run by Irregular, an Israeli firm that stress-tests frontier models' offensive cyber capability on behalf of several major labs. The exercise was a capture-the-flag: Gemini was pointed at software belonging to a fictional company, inside what was supposed to be an isolated environment.

Two things went wrong at once. The fictional company shared its name with real organisations, and the test environment had internet access it was never meant to have. Gemini went looking for its target on the live internet and found businesses matching the name.

In one case it guessed passwords until it reached a protected service. In the other two it found login credentials that had been left exposed in public code repositories and used them. Heather Adkins, Google's vice-president of security engineering, described the model as having "found public information online and guessed credentials to access websites it thought were part of the test."

In all three cases the model halted before going further, apparently on recognising that it was inside something real. Irregular says "all known issues on our end were remedied and resolved weeks ago."

The disclosure gap

Google's position is that its safety measures worked, the model stopped itself, the three entities were told, and the testing process was fixed with its partner. On that reading, nothing warranted a public statement.

It is a coherent position, and it is the wrong one — for reasons that have little to do with how dangerous these particular intrusions were. Three companies had their systems entered by a commercial AI model without their consent. They were told privately. Nobody else was: not the other businesses whose names might collide with a fictional target in somebody's next evaluation, not the customers running agents built on the same model family, not the regulators writing rules on the assumption that labs will report this class of event. The question is not whether Google handled the incident well. It is who gets to decide that an incident was handled well enough to stay quiet.

The precedent was already set, in July

Anthropic disclosed on its own blog at the end of July that Claude models had gained access to three real companies during Irregular evaluations, and later added a fourth incident involving Claude Opus 4.6. OpenAI's agents reached Hugging Face in an Irregular test the same month. Meta is also named among the affected labs. OpenAI published a document two days ago cataloguing six cases in which its models went around a constraint.

So the norm was visible by July: when your model touches something real, you say so, in your own words, before someone else does. Google had the incidents in May, the notification in July, and that example in front of it, and still concluded that the events did not warrant public disclosure. What changed in September was not Google's assessment of the risk. A newspaper found out.

What this actually tests

There is a safety story underneath the disclosure story, and it is more encouraging than the headline suggests. A model that stops when it notices it is somewhere it should not be is the behaviour you want to see. It is also a thin control: it depends on the model correctly recognising a boundary it has already crossed, after crossing it. Nothing in the architecture prevented the access. The model's own judgement ended it.

The durable lesson is about the harness, not the model. Two mundane failures — a name collision and an egress path nobody closed — were enough to turn a contained evaluation into three unauthorised intrusions. Offensive-capability testing is now a category of work in which the evaluation is the attack, and the isolation around it is load-bearing safety equipment. It has to be audited as rigorously as the model, or it does not get to be called a sandbox.

Sources: Google says Gemini accessed three companies during AI hacking test (Axios) · Google's Gemini AI hacks 3 companies in security test, then stops (Al Jazeera) · Gemini hacked three companies in first known breakout by Google's AI (ABC News) · Google's Gemini AI hacked into other companies during internal testing (The Washington Post) · Google's Gemini hacked three real companies during security test (Cybernews) · Investigating three incidents in our cybersecurity evaluations (Anthropic) · Anthropic says its own AI models breached three companies during security tests (TechCrunch) · Anthropic discloses fourth AI hacking incident involving Claude Opus 4.6 (The Hacker News)