Google confirmed that a Gemini model accessed three real companies in a May cybersecurity evaluation after the exercise could reach the public internet and confused a fictional target with a real one. The episode matters because it demonstrates that an agent need not defeat a hardened sandbox to create real-world cyber risk: an ordinary evaluation design error can turn a capable model's assigned objective into live access.
Key facts
- Google says three organizations were reached during a May 2026 evaluation.
- The evaluator, Irregular, says a fictional name coincided with a real domain and internet controls were inadequate.
- One run used password guessing; two used credentials found in public repositories, according to Google's reporter-carried statement.
- Google says the model stopped after recognizing real systems; no victims, model version, or evidence of data exfiltration is public.
The setup was an external, multi-stage cyber exercise, not a public Gemini product deciding to roam the internet. Irregular's cyber-evaluation description explains the basic pattern: a model receives an objective, target details and tools, then plans reconnaissance and execution until it reaches a hidden success condition. Here the target was supposed to be fictional. A live route turned that fictional map label into a real address.
Google security leader Heather Adkins said the model found public information online and guessed credentials to access websites it thought were part of the test; she added that in all three instances the model stopped. That is an important mitigation, but not a clean safety boundary. The system had already authenticated to protected services before it understood its error. The disclosed mechanisms are mundane rather than exotic: weak passwords and credentials exposed in public code. That is precisely why the event is useful security evidence. An AI agent does not need a novel exploit when an environment gives it a goal, network reach, and ordinary attack paths.
Think of a fire drill whose map accidentally labels a real emergency exit as the training exit. A participant following instructions may cross the wrong door; the primary failure is the building's boundary and signage, although the participant's ability to open doors still determines the consequence. Irregular says it disabled the affected evaluation, reviewed logs, notified affected parties and added safeguards and manual review. Its broader lesson is that rare, hundreds-of-turn trajectories need continuous containment checks, not a one-time assumption that a simulation remains fictitious.
A defensible control program begins before a run: reserve fake domains and names, deny public DNS and network egress by default, issue credentials that work only against the range, and test those barriers with an independent probe. During a run, log every external resolution, authentication attempt and tool invocation, then pause on anomalies rather than relying on a model to narrate its own uncertainty. Afterward, investigators need enough telemetry to distinguish attempted reachability from successful authentication and data access. These are familiar security disciplines, but agent evaluations turn them from nice-to-haves into preconditions.
The strongest counterargument is that this says little about a uniquely rogue Gemini capability. Irregular itself says the episode does not reveal anything especially distinctive about one model and points to evaluation infrastructure; the real systems reportedly lacked common security practices. That counterargument is persuasive as far as it goes. It does not erase the practical fact that frontier-agent testing now needs the same defense in depth as a production offensive-security system: egress controls, invented names that cannot resolve publicly, scoped credentials, real-time monitoring and human review. The incident belongs beside the wider lesson in sandboxing AI agents: safety is a property of the model-plus-tools system, not a promise made by model behavior alone.
Originally published on Ground Truth, where every claim is checked against the primary source.
