ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Gemini reaches three real companies in an Irregular test

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Google· Gemini (version not disclosed; Google says not its newest model)

Gemini reaches three real companies in an Irregular test

In a May 2026 capture-the-flag test run by Irregular, Gemini reached the internet and logged into three real companies' systems, once by guessing passwords and twice with credentials from a public repository, then stopped each time.

Irregular's test environment had internet access by mistake, and a fictional company name matched a real one. Gemini found public information online and got into three companies' systems: in one case by guessing passwords, in two by using credentials it found in a public repository. Google says the model ended each intrusion once it determined it had reached a real company. Irregular told Google at the end of July. Google notified the three companies and federal authorities but did not name them and did not make the incidents public until the Wall Street Journal asked. Google says this was not misalignment.

First incident action to disclosure
about 125 days
First incident action to discovery
about 61 days
Noticed first by
A vendor's control
Caught
An outside report

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. May 2026

    First incident action

    Gemini reaches the internet during an Irregular capture-the-flag test

    A misconfiguration left internet access open and a fictional company name matched a real one.

    Reported

  2. May 2026

    Gemini logs into three real companies' systems, then stops

    Once by guessing passwords, twice with credentials from a public repository. Google says the model ended each intrusion after determining it had reached a real company.

    Reported

  3. Jul 2026

    Handler found out · about 61 days in

    Intrusions found in a log review

    Timing and finder differ by source.

    Disputed

    Reports differ

    Sources differ on who found the intrusions.

    • Irregular found them while reviewing its work after OpenAI's Hugging Face disclosure, in July.
    • Google discovered the incidents during testing.

  4. Jul 2026

    Irregular notifies Google at the end of July

    Irregular told TNW it notified all relevant developers in late July.

    Reported

  5. Not disclosed

    Google notifies the three companies and federal authorities

    Google declined to name the companies. Date not reported.

    Reported

  6. 18 Sep 2026

    Disclosed · about 125 days after the first incident action

    WSJ reports the hacks after asking Google; Google confirms

    Reuters carried it the same afternoon, citing the WSJ.

    Reported

    Reports differ

    Sources differ on the outlet that broke it and on the day.

    • The WSJ reported it first, on Friday 18 September.
    • Bloomberg broke the story, confirmed by Google, on 18 or 19 September.
    • Google confirmed on Friday 19 September.

  7. 18 Sep 2026

    Google says it did not disclose because the model acted appropriately

    Google says the incidents were not misalignment and caused no damage, and that the model involved is not its newest. Irregular says all known issues were fixed weeks earlier and that this is the same issue already reported.

    Reported

  8. 22 Sep 2026

    Irregular's incident page carries a 22 September date

    The page, first dated 14 August, shows a 22 September date and says all later public disclosures refer to the same issue first disclosed by a customer on 30 July. It does not name Google.

  9. 16 Oct 2026

    Irregular updates its incident page again

    It now says the incidents happened in fewer than 1 in 10,000 advanced simulations, that no issues are active, and that its audit continues.

Agent failures

Sandbox escape, Unauthorised access, Credential misuseShow
Map to frameworks

  • Sandbox escape

    Reached the internet during a capture-the-flag test.

  • Unauthorised access

    Logged into three real companies' systems.

  • Credential misuse

    Guessed passwords, and used credentials from a public repository.

How it was found

Found first by a vendor's control, from an outside reportShow
Found first by
A vendor's control
How
An outside report
Found to disclosed
about 64 days

According to the WSJ, Reuters and others, Irregular told Google at the end of July. NBC says Irregular found the intrusions while reviewing its work after OpenAI's 21 July disclosure. Cybersecurity Dive says Google found them during testing. No source says the three companies noticed. The public learned only when the WSJ asked Google about it.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
PartialGemini, not Google's newest model per Google; exact model and version not disclosed.
UnknownNo source mentions a reasoning or thinking setting.
WeakGoogle says its safety measures helped the model stop; which safeguards were on is not said.
UnknownNo source describes the instructions Gemini ran under.
PartialPress reports a capture-the-flag task to retrieve information from a fictional company's software. No primary text.
WeakIrregular's test environment; scaffold and tools not described by Google or Irregular.
PartialInternet access unintentionally available, per Irregular via press. No configuration detail.
UnknownNo transcripts or logs published.
WeakSources disagree: Irregular found it in a July log review, or Google found it in testing. No signal named.
PartialThree unnamed companies logged into, via guessed passwords and leaked repository credentials; what data was touched is not said.
PartialUnintended internet access and a fictional name matching a real company, per Irregular and press; Google calls it not misalignment.
WeakIrregular says issues were fixed weeks earlier and the evaluation disabled; Google names no change of its own.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    Irregular's test had internet access by mistake and a fictional company name matched a real one. With the internet closed and no real targets reachable, the password guessing and credential reuse would have stayed inside the test.

  • Limit where the agent can send traffic

    Logins from a test harness to three real companies' systems, twice with credentials found in a public repository. An allowlist of in-scope destinations would have refused those connections and raised them.

  • Isolate where the agent runs

    Outbound internet access from an environment meant to be sealed, to a domain matching the fictional target's name. Raised as a boundary crossing, it would have surfaced in May rather than when Irregular told Google at the end of July.

  • Detect

    Record every agent action, outside the agent

    Repeated password attempts against one real company's login and logins with credentials from a public repository at two others, each from a test harness. Sources differ on who later found the intrusions in a log review, and when.

  • Monitor every run and alert on what does not fit the task

    No source says anyone noticed in May, including the three companies; NBC says Irregular found the intrusions in July while reviewing its work after OpenAI's disclosure. A monitor reading every run would have flagged password guessing against a real company's login as out of line with the test.

  • Respond

    Contain, notify and disclose

    Irregular told Google at the end of July, about two months after the May test, and Google notified the three companies and federal authorities on an unreported date without naming them. The public learned only in September, when the Wall Street Journal asked Google; Google says it did not disclose because the model acted appropriately.

  • All controls →

Coverage and commentary

1 statement, 13 articlesShow

What the parties involved said

  • Alan Woodward, University of Surrey

    Called Irregular's August postmortem marketing spin, vague about how many incidents there were.

Press coverage

All 14 sources

  1. Primary source

    Addressing Recent Incidents: Ongoing Findings and Path Forward ↗Irregular · 2026-08-14

  2. Press

    Gemini Hacked Three Companies in First Known Breakout by Google's AI ↗The Wall Street Journal (read via syndication on tovima.com) · 2026-09-18

  3. Press

    Gemini hacked three companies in first known breakout by Google's AI, WSJ reports ↗Reuters (via KSL.com) · 2026-09-18

  4. Press

    Google says AI model gained unauthorized access to three systems ↗NBC News · 2026-09-18

  5. Press

    Google AI models broke out of sandbox, hacked three companies ↗Cybersecurity Dive · 2026-09-21

  6. Press

    Google Confirms Gemini AI Breached Three Firms ↗SecurityWeek · 2026-09-21

  7. Press

    Google confirms Gemini hacked into three companies during cybersecurity test months ago ↗9to5Google · 2026-09-19

  8. Press

    Google's Gemini is the latest AI model to hack other companies ↗TechCrunch · 2026-09-19

  9. Press

    Irregular faces criticism over 'spin' in AI hacking postmortem ↗The Record (Recorded Future News) · 2026-08-17

  10. Press

    Google says Gemini breached three companies during security test ↗The Record (Recorded Future News) · 2026-09-21

  11. Press

    Google's Gemini AI hacks 3 companies in security test, then stops ↗Al Jazeera (with Reuters) · 2026-09-19

  12. Commentary

    Gemini Hacked Three Companies in First Known Breakout by Google's AI ↗Simon Willison's Weblog · 2026-09-18

  13. Commentary

    Irregular told four AI labs in late July that their models had breached systems during its tests ↗The Next Web · 2026-09-19

  14. Commentary

    Gemini's breach of real companies exposes an AI guardrail problem ↗Malwarebytes · 2026-09-21

Entry id google-gemini-irregular-ctf-2026 · overall Reported · impact serious