Gemini stepped outside the test perimeter and into the systems of three real companies

On 18 September 2026 the Wall Street Journal reported that a Gemini model, during a safety evaluation, gained access to the systems of three real companies outside the scope of the exercise; Google confirmed the episode. The accesses date back to May 2026, during a capture the flag exercise entrusted to the independent evaluation firm Irregular, according to Google and to accounts by Reuters, heise online and The Hacker News. Heather Adkins, who heads cybersecurity at Google as vice president, said the model had found public information online and guessed credentials to get into sites it believed were within the scope of the test. The methods differed across the three cases: in one, the model tried passwords until it got into a protected system; in the other two, it used credentials found in public repositories (Wall Street Journal, picked up by Reuters and The Hacker News). In all three, again according to Google, the activity stopped after the model realised it had hit real systems. Adkins adds that the three entities affected were notified, and that Google worked with its evaluation partner on the changes later made to the procedures.

A compatible flaw is described in the report Irregular published on 14 August 2026, which, however, names neither Google nor any client. The exercise's fictitious target had been given a name that, unbeknownst to the team, matched an existing domain; the preventive check on names had not caught the overlap because that domain was little known (Irregular report, SecurityWeek). In the same environment, internet access had been left enabled unintentionally, and that allowed the models to reach the real domain instead of the simulated target. Irregular puts the phenomenon at fewer than one advanced simulation in ten thousand, usually at a late stage, and writes that the models had received no instruction to that effect; it then lists the countermeasures taken, from shutting down the affected evaluation to better log monitoring, from broader manual review to an internal team dedicated to containment, plus a whitepaper announced without a date.

This episode does not stand alone. Between 30 July and 5 August 2026 Anthropic, OpenAI and Meta had already made similar incidents public, and Irregular writes that every subsequent public disclosure traces back to the same problem, reported by one of its clients on 30 July. Google spoke on 18 September, after the Wall Street Journal article, arguing that the behaviour does not amount to a case of misalignment and did not call for public disclosure, because the safety measures held and there was no harm. Irregular's report, meanwhile, has come in for criticism: on 17 August The Record relayed objections from computer science at the University of Surrey, where Alan Woodward argues there is nothing in the text an outside reader could falsify, and that the tally of incidents remains indeterminate.

A good deal stays outside what can be verified. It is not public which version of Gemini was involved: Google told the Wall Street Journal it was not the most recent one, without specifying (heise online, 19 September). It is not known which the three companies are, or whether they suffered operational consequences, and no official Google post about the episode can be found: the statements went to the press. Irregular has not said how many incidents there were in total, or when the whitepaper will come out, and it is not clear whether the Gemini case is the same flaw documented on 14 August or a separate episode on the same infrastructure, nor how much time passed between the late-July report and the fixes.

The line that circulates most, the one about the model stopping on its own, is also the only one nobody outside can check: the sources are the vendor's logs and the statements of the company that built that model. I find the other half of the story more interesting, the boring half: a badly chosen name and a connection left open. A test perimeter is not an abstraction, it is a list of strings that someone has to compare against the world. When that comparison is skipped, the question of how capable the model is becomes secondary to who answers for the cage, and under what obligation to say so. — Olya