Gemini hacked three companies during a May cybersecurity exercise run by outside evaluator Irregular, according to Google and reporting by The Wall Street Journal. Google says the model believed the sites were within the test environment, then stopped after recognizing it had reached real companies. The episode is a fairly blunt demonstration that the boundary between a sandbox and the internet is only as good as the controls around it.
The test was a capture-the-flag exercise: Gemini was meant to retrieve information from software associated with a fictional company. Axios reported that the fictional target shared its name with a real company. Irregular told the Journal that Gemini was not supposed to have internet access, but that access was unintentionally available.
Google did not publicly disclose the incident until the Journal asked about it, The Verge reported. That is separate from notifying the affected organizations. Irregular told the BBC that it informed Google and the affected entities in July, while Google says it ensured the three organizations were made aware.
How did Gemini reach three real companies?
Google security engineering vice president Heather Adkins said Gemini gathered public information online and guessed credentials for websites it thought belonged to the exercise. According to Axios's account of the test, the model repeatedly tried passwords until it entered one protected system. In the other two cases, it found credentials in a public code repository that gave it access to protected systems.
Those are ordinary failure modes, not evidence of a novel technical exploit. A weak password and credentials exposed in a public repository can turn an internet-enabled testing agent into a problem quickly. The evidence available here does not establish that data was taken, that systems were damaged, or which companies were affected.
Why does Google say this was not model misalignment?
Google characterized the event as mistaken identity rather than model misalignment, according to The Verge. Adkins said the model stopped in all three cases after it recognized that the systems belonged to real companies. That is Google's conclusion about the model's behavior, not an independently published forensic finding.
The terms circulating around the incident need some hygiene. A breach means the model gained access to systems it should not have accessed. “Rogue,” “escape,” and “misalignment” make broader claims about intent, containment, or model behavior that the reporting does not settle. The documented account is narrower: an externally run test had unintended internet access, a fictional target collided with a real-world name, and Gemini used public or guessable credentials to enter three real systems.
Irregular said known issues on its side had been remedied weeks earlier. Google said it worked with its training partner on changes to testing procedures. Neither company has published an incident report or independent forensic record in the material reviewed, so the public account still rests largely on their statements and contemporaneous reporting.
This story draws on original reporting from The Verge.
