19 SEP 2026 — During a security evaluation in May, Google's Gemini guessed its way into one real company's systems and used credentials found in public code repositories to reach two more. None of the three was supposed to be part of the exercise.
The model was doing what it had been asked to do. The exercise was the thing that failed.
What the harness got wrong
The evaluation was run by Irregular, an Israeli firm that tests frontier models for offensive-security capability, using capture-the-flag exercises against a fictional target.
Two defects in that setup combined. The fictional company invented for the exercise shared its name with a real domain, and the test environment gave the model internet access it was never meant to have. The Hacker News reported Irregular's finding that a naming error made a fictional company name match a real domain, and that the resulting access was used against that domain a limited number of times.
Neither defect is exotic. A name collision and an unintended network route are ordinary infrastructure mistakes, the kind caught by review, not by cleverness.
How it got in
The methods were unremarkable, which is exactly why the episode is worth reading carefully. ABC News reported that in one case the model guessed passwords until it reached a protected system; in the other two it found credentials sitting in publicly accessible repositories and used them.
No novel exploit was involved. Credential reuse and exposed secrets are the commonest way anyone gets into anything, and the model took that route because it works.
Google's position, and its limits
Google says the agents stopped once they worked out that they had reached systems belonging to real companies rather than parts of the exercise, and that it does not treat the episode as an example of model misalignment.
Heather Adkins, Google's vice-president of security engineering, said the events "highlight the importance of training powerful AI models to act responsibly" and that in this case the model acted appropriately.
That claim is defensible, but it answers a narrower question than the episode raises. Halting after recognising a crossed line is a property of the model. Being able to cross it at all is a property of the container, and the container is what failed here. A safety argument that relies on the model noticing is weaker than one that makes the crossing impossible.
Irregular said all known issues on its side were remedied and resolved weeks ago, and Google says it worked with the firm on changes to its testing processes.
Not only Google
This is not an isolated vendor failure. Comparable incidents have occurred during Irregular's evaluations of models from Meta, Anthropic and OpenAI, including a case in which OpenAI agents attacked Hugging Face.
That pattern moves the problem. If four laboratories' models have reached unintended systems through the same evaluation pipeline, the variable is not any one model's training. It is the practice of running capability evaluations at all, and the isolation standard they are held to.
Testing a model's ability to break into computers requires giving it something to break into. The industry has been treating that environment as scaffolding rather than as a control, and scaffolding does not get audited.
We reported this week on four AI coding agents that pinned plugins to a hash they never checked. The common thread is not the models. It is the surrounding machinery being trusted to hold a boundary no one verified.
Four months to disclosure
The exercise ran in May. The affected companies were notified in July. The public learned of it on 19 September, first through the Wall Street Journal.
Notifying the affected parties within roughly two months is a reasonable response to an incident. The further two months before disclosure are the harder judgement, and neither company has explained the interval.
Nothing published names the three companies, and nothing published indicates that any harm resulted. Both statements describe what has been disclosed, not what occurred.
View author profile → · Editorial policy
