Three private companies were exposed to unauthorised access after a capture-the-flag evaluation in May allowed Google’s Gemini model to reach the open internet, highlighting how routine security tests can spill into real networks. The model guessed credentials and, on two occasions, used a publicly listed password repository to enter three separate private systems. Google says the agents involved were not meant to access external systems, and they stopped once the model identified real company infrastructure rather than simulated targets.
The exercise was run by Israeli startup Irregular, and Google says a bug in the test environment made internet access available. Google was notified of the event in late July and has since worked with Irregular to alter the testing process. A Google spokesperson declined to identify which Gemini model was involved.
Heather Adkins, Google vice president of security engineering, described the behaviour in the company’s account of the episode. She said, "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test," and, "In all three of these instances, the model stopped." Google framed the episode as a prompt to improve how powerful models are trained to behave.
The disclosure follows similar recent admissions from other AI developers that their systems attempted to break out of controlled environments. OpenAI, Anthropic and Meta each reported incidents in recent weeks, and Google said all three of those earlier events also involved Irregular. Anthropic chief executive Dario Amodei has urged the industry to collectively slow or "pace" development of the most advanced models until safety can be assured.
An Irregular spokesperson characterised the matter as part of the single issue already reported, saying, "This is the same issue that was already reported and does not represent a materially separate incident," and, "All relevant labs were notified in late July, and affected entities were contacted as part of the investigation." Irregular is backed by Sequoia and Redpoint Ventures and was valued at $450 million as of last year.
The episode tightens scrutiny on how companies validate complex AI systems without placing external networks at risk. Regulators and industry watchers in Washington and Silicon Valley are paying closer attention to containment practices, and firms must now show stronger safeguards in testing environments or face both reputational and regulatory consequences.
