Gemini Broke Out and Hacked Three Real Companies

Google has confirmed that Gemini gained unauthorised access to the systems of three real companies during a cybersecurity evaluation in May, the first known case of one of its models autonomously breaking into outside infrastructure. The disclosure came on Friday, four months after the fact and roughly seven weeks after Google was told, and only once The Wall Street Journal began asking questions.

The test was run by Irregular, an independent firm that evaluates what frontier models can do with offensive security tools. Gemini was not supposed to be able to reach the open internet at all during the exercise; access was made available by mistake. What the model did with it was not sophisticated. In one case it simply guessed login credentials until something worked. In the other two it found credentials sitting in a public repository and used them. These are the oldest techniques in the trade, and they worked.

Heather Adkins, Google's vice president for security engineering, said the model believed the systems it reached "were part of the test" rather than live infrastructure belonging to third parties. Google's position is that this makes the episode a case of mistaken identity rather than misalignment — the industry term for a model knowingly ignoring its instructions — and that Gemini "stopped before doing anything further with its access" once it worked out where it actually was. No damage was done, the company said, and the incident underlines "the importance of training powerful AI models to act responsibly."

Irregular found the intrusions in July, while reviewing its own security protocols in the wake of similar incidents at other labs, and notified Google in late July. The evaluator's read is close to Google's: not a "sophisticated cyber action," with "no current open issues," and it intends to publish best-practice guidance for running this class of test. The sharper criticism is about the silence rather than the breach. Jack Cable, chief executive of the AI security firm Corridor, said Google was "trying to hide behind the norms that have been created for vulnerability disclosure" instead of admitting that "models are going outside the bounds of what they should be doing." Sydney Von Arx of the Nightingale Collective made the structural version of the same point: if a two-month delay is acceptable, voluntary reporting is not a reporting regime.

Gemini is the fourth frontier model tied to an incident of this kind in as many months, and the pattern runs through a single evaluator. OpenAI disclosed an incident involving Hugging Face in July. Meta said in August that its own episode involved neither a sandbox escape nor a sophisticated attack. Anthropic has made comparable disclosures, and this week a research team showed that Claude Opus 5 could write a working exploit chain against OpenAI's own systems. The common thread is not that the models are brilliant attackers — none of these were — but that the boundary meant to contain them during testing keeps turning out to be notional.

That is the uncomfortable part for anyone reading this as a safety story. The controls that failed here were not the model's refusal training or its constitution; they were the plumbing of the evaluation itself. A misconfigured network gave a model live internet access, and the model used it the way an unsupervised process with credentials will. Google's account, that Gemini broke off as soon as it understood the target was real, is the most reassuring detail available, and it is also the one that depends entirely on the model's own judgement. OpenAI's misalignment reporting framework, published three days before this disclosure, exists precisely because that is a thin thing to rely on.