Gemini Reached Three Real Companies After a Test Escaped Its Sandbox

Google's Gemini accessed three real companies during a May security test after an outside lab accidentally left the internet connection open. Google disclosed it only after journalists began asking questions.

Google says Gemini accessed the systems of three real companies during a May 2026 cybersecurity evaluation run by Irregular, an external AI-testing firm.¹
The test was meant to target a fictional company inside a closed environment. A configuration error gave the model access to the public internet.²
Gemini guessed a password in one case and found exposed credentials in public software repositories in two others.³
Google says the model stopped each time after recognising that it had reached a real company; it has not named the firms or said whether data was copied or changed.⁴
Irregular told Google about the incidents only at the end of July. Google publicly confirmed them on 18 September, after The Wall Street Journal asked about the episode.⁵

The failure was not that Gemini defeated an impenetrable defence. It was that a supposedly contained test quietly became a live operation against real targets. The model followed the task it had been given, used information available online and treated real systems as part of the exercise until it recognised the mistake.

That makes this a test-design and accountability failure as much as a model-safety story. The companies affected were not given a choice about taking part, and the public still does not know which systems Gemini entered or what it did inside them. Google says the model acted appropriately because it stopped. But the more immediate lesson is harsher: an agent that can search, guess credentials and log into services needs containment that does not depend on the agent noticing when it has crossed a line.

Gemini Reached Three Real Companies After a Test Escaped Its Sandbox

Footnotes