Summary
- Google confirmed Gemini accessed systems belonging to three real companies during a May cybersecurity evaluation conducted by Irregular.
- The model was intended to operate against simulated targets but had internet access and encountered real organisations sharing or resembling test targets.
- Google says Gemini stopped in all three cases and the affected organisations were informed.
Google has confirmed that its Gemini AI accessed protected systems belonging to three real companies during a cybersecurity evaluation, after a test environment intended to contain simulated targets was inadvertently connected to the public internet.
The incidents occurred in May while AI security company Irregular was assessing the cyber capabilities of Google’s Gemini model. They were first publicly detailed in reporting by The Wall Street Journal and subsequently confirmed by Google.
The evaluation was designed around fictitious organisations. In one case, a fictional company had the same name as a real organisation, and Gemini reached the real service after internet access became available. Google said the model guessed a password and stopped after recognising that the target was not part of the simulated test.
In two other cases, the model located credentials in publicly accessible repositories and used them to access services belonging to real organisations, according to accounts of the evaluation. Google said Gemini stopped in those cases as well.
Heather Adkins, Google’s vice-president of security engineering, said the three affected organisations were informed and testing procedures were changed. Google has not characterised the incidents as evidence that Gemini deliberately escaped its controls or developed an objective outside the task it had been given.
The distinction is important. The events were not a conventional cyberattack initiated autonomously without instruction. Gemini was operating inside a cybersecurity evaluation in which it had been asked to interact with targets. The failure occurred because the boundary between the artificial environment and the public internet was insufficiently robust.
That still creates a serious control problem for systems capable of executing security tasks. Traditional test environments assume tooling will remain within scope because network segmentation, credentials, or operator controls enforce the boundary. An AI agent can search, interpret ambiguous information, choose targets, and attempt credentials as part of the task it has been given.
If the environment exposes a real service that appears to satisfy the test objective, the model may not have a reliable basis for distinguishing authorised simulation from an unauthorised external system. Scope therefore needs to exist as an enforceable technical property rather than an instruction expressed only in natural language.
The incidents also show why powerful cyber agents create risk even when their behaviour is aligned with the requested objective. A model does not need to become malicious to cause an unauthorised action. A valid task, combined with an incorrectly configured environment, ambiguous asset identity, or exposed credentials, can be sufficient.
This shifts part of AI security back into familiar areas of operational engineering: network egress, identity isolation, target allowlists, credential controls, test-data design, and monitoring. Model-level safeguards remain important, but they do not replace hard boundaries around systems that can make network connections and act on authenticated services.
The episode follows similar disclosures involving other advanced AI models during cyber evaluations, suggesting that the problem is not unique to one provider. As agents gain greater autonomy, test infrastructure will need to assume that a capable model may find paths that human evaluators did not anticipate.
Google’s account that Gemini stopped once it recognised the systems were real limits the scope of the incidents, but it does not remove the underlying governance issue. The systems were reached before that distinction was made, showing that containment has to operate before an agent can cross the boundary rather than depend on the agent recognising the mistake afterwards.
