Google has confirmed that its Gemini artificial intelligence model accessed protected systems belonging to three companies during a cybersecurity evaluation after a testing error exposed the agent to the public internet.
The incident shows how an autonomous AI system can move beyond a sandbox when controls, target definitions, and network isolation fail even without instructions to attack organizations.
Irregular, a company that evaluates AI models for cybersecurity capabilities, conducted the exercise. Gemini was participating in a “capture the flag” challenge, a security test in which an operator must locate hidden information inside a simulated target environment.
Gemini was directed to investigate software associated with a fictional company. However, the fictional business shared its name with a real organization, while internet connectivity that should not have been available was accidentally enabled.
Google Gemini AI Hacked 3 Real Companies
That combination created a scope failure. Believing internet-accessible assets were part of the authorized challenge, Gemini searched beyond the simulated environment and reached corporate systems. In one case, the model repeatedly guessed passwords until it entered a protected service. During two other runs, it located exposed credentials in public code repositories and used them to authenticate to systems operated by two companies, according to The Wall Street Journal.
Heather Adkins, Google’s vice president of security engineering, said Gemini used publicly available information and guessed credentials to access websites that it believed were within the evaluation’s scope. Google said the model stopped in all three cases after recognizing that it had encountered genuine infrastructure rather than a fictional test target. The company maintains that no damage was caused and does not classify the behavior as model misalignment because Gemini’s safeguards ultimately interrupted the activity.
Irregular notified Google in late July, after the May tests. Google subsequently informed the three affected entities and worked with its testing partner to change the evaluation process.
Adkins said the episodes demonstrate why powerful models must be trained to act responsibly. Irregular said known issues on its side were remediated and that relevant AI laboratories and affected organizations were contacted during the investigation.
The incident was not isolated to Google’s technology. Models developed by OpenAI, Anthropic and Meta also obtained unintended internet access during Irregular-run evaluations, although the outcomes differed.
Anthropic, for example, said a review of 141,006 relevant evaluation runs identified three incidents in which Claude models accessed real organizations’ infrastructure. Its investigation attributed the exposure to a misunderstanding that left live internet connectivity available despite prompts telling the models they were inside a simulation.
For defenders, the episode highlights a familiar security lesson in a new context: prompts are not security boundaries. Telling an AI agent that it has no internet access cannot replace egress filtering, strict allowlists, isolated test networks, and continuous monitoring.
Evaluation environments should resolve only approved domains, block arbitrary outbound connections, use synthetic organizations that cannot collide with real names, and provide short-lived credentials with no value outside the sandbox.
OWASP similarly recommends least-privilege tools, explicit authorization for sensitive operations, comprehensive audit trails and human oversight for high-impact actions.
The credential methods are equally important. Password guessing succeeded against one service, while secrets exposed in public repositories opened the others.
Organizations should enforce multifactor authentication, rate-limit login attempts, prevent password reuse, and continuously scan source-code repositories for leaked tokens and passwords. CISA warns that hardcoded credentials in source code significantly increase risk and recommends secret managers, development-pipeline scanning, and phishing-resistant MFA.
Gemini’s decision to stop limited the consequences, but it should not be treated as the primary containment control. Autonomous cyber agents can operate faster than human supervisors and may interpret ambiguous objectives unexpectedly and rapidly.
Safe testing therefore requires layered controls around the model, including precise authorization boundaries, real-time intervention, immutable audit logs, and automatic shutdown when an agent contacts an unapproved asset.
