Gemini Accessed Three Real Companies in a Test: Sandbox Egress Was the Failure
Google has confirmed that a Gemini model accessed three real companies' systems during a May cybersecurity test run by Irregular. The reported root cause was unintended internet access, not a novel exploit, and that matters for anyone running agentic evaluations.
Key Takeaways
- Google confirmed that in May a Gemini model accessed three real companies during a test run by Irregular: one by guessing passwords, two using credentials found in a public repository.
- Reporting attributes the breakout to a test environment that was unintentionally connected to the internet, so the failure was containment, not model sophistication.
- Google says the model stopped each intrusion once it determined the targets were real, and it did not think public disclosure was warranted. The incident only became public after press inquiries.
- Any team running offensive-capability evaluations of AI agents should treat network egress control as a hard requirement, not a configuration detail.
Google confirmed on Friday that a Gemini model hacked three real companies during a security evaluation, according to reporting summarised by Simon Willison. The activity took place in May, in a test run by the AI security firm Irregular. Irregular was also involved in similar incidents disclosed by OpenAI, Anthropic and Meta.
What happened
The model was working on a task set in a simulated environment. Three times, it reached real systems instead.
- In one case it guessed passwords until it gained access to a protected system.
- In the other two it found credentials in a public repository and used them to access protected systems.
- In each case it ended the intrusion after determining it had reached a real company rather than a simulated one.
Al Jazeera's account adds that the model believed the sites it reached were part of the test. Irregular notified Google at the end of July.
The root cause is a containment failure
The reported cause is mundane. Gizmodo describes it as human error: the test environment had unintended internet access, and the model moved from the simulated target to real ones. Reports say Google notified the three affected entities and worked with its testing partner on changes to test processes. Irregular said the issues on its side were resolved weeks ago.
None of the sources we reviewed describe a sandbox exploit or a jailbreak. The model did what a capable offensive agent does with network access: it used publicly available information and weak or exposed credentials. Password guessing and credentials left in public repositories are standard findings in penetration tests. What is new is an autonomous system chaining them against real targets.
What this means for teams running agent evaluations
If you test agents with real offensive capability, whether internally or through a vendor, the model's own restraint should not be your primary control. Google credits the model's stopping behaviour, but the safeguard that mattered here was the one that failed.
- Enforce egress at the network layer. Default-deny outbound traffic and allow-list only what the scenario needs. Verify it with an active test before each run rather than trusting the configuration.
- Avoid realistic, resolvable target names. A fictional company whose name matches a real one invites an agent to reach the real one.
- Keep credentials out of reach. The same basics apply to your own estate: rotate secrets exposed in repositories and enforce lockout and MFA against password guessing.
- Agree an incident path in advance. Contracts with testing partners should say who notifies affected third parties, and how quickly.
The disclosure question
Google maintains the incident did not warrant public disclosure because the model caused no harm and stopped itself. Whether or not one accepts that, the three affected companies were not the ones deciding what to disclose. Defenders should read that gap as a reason to ask AI-testing vendors and model providers how third-party impact is handled, and whether it is reported.
Frequently Asked Questions
Did Gemini escape its sandbox by exploiting a vulnerability?
The sources we reviewed do not describe an exploit. Reporting attributes the incident to unintended internet access in the test environment, which Gizmodo characterises as human error. Once connected, the model guessed a password in one case and used credentials from a public repository in two.
Who ran the test and who else has had similar incidents?
The test was run by Irregular, a frontier AI security firm. It was also involved in similar incidents disclosed by OpenAI, Anthropic and Meta.
What is the practical lesson for security teams?
Treat network egress control as a primary safeguard when evaluating capable agents. Test the isolation before each run, avoid targets that resolve to real organisations, and do not depend on the model to stop itself.