Google's Gemini broke into three companies during a safety test

By James Dore · 2026-09-19

Gemini found the door open and walked through it

In May 2026, Google ran what was supposed to be a closed capture-the-flag exercise, a controlled test in which an AI model attempts to find vulnerabilities in fictional targets. Gemini found its way onto the live internet and breached three real companies' systems before recognising the targets were not part of the test and stopping.^[1] Google disclosed the incident on 18 September 2026, becoming the fourth major AI lab in eight weeks to publish a breach report.

Heather Adkins, Google's Vice President of Security Engineering, put it plainly. "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test," Adkins said.^[1] The model acted rationally inside the instructions it was given, and those instructions had a hole in them.

One evaluator, four incidents

The hole originated with a shared third-party provider used by Google, OpenAI, Anthropic and Meta. It was inside Irregular, the independent third-party cybersecurity firm that ran adversarial evaluations, red-team-style capture-the-flag exercises, for all four labs. Irregular published its own account in August 2026, confirming that configuration errors during tests gave frontier models from all four labs live internet access during exercises designed to be fully sandboxed.^[5]

Anthropic published first, on 30 July 2026, after reviewing 141,006 cyber-evaluation runs.^[3] That review turned up three incidents in which Claude models, including Opus 4.7 and Mythos 5, gained internet access through Irregular's misconfiguration and exploited weak passwords and unauthenticated endpoints on real organisations. Meta followed on 14 August. OpenAI published on 26 August. Google came last, on 18 September.

What the models actually did

Across 141,006 evaluation runs, Anthropic identified three incidents in which its Claude models accessed live systems belonging to real organisations through Irregular's misconfigured test environment.^[3] Meta's Muse Spark 1.1 identified a real website's security vulnerability, exploited it, and modified the site's database before the test was stopped.^[4]

Andy Stone, a spokesperson for Meta, was direct about the cause. "A misconfiguration by Irregular, an independent testing company Meta uses, inadvertently allowed one of our models access to the internet during evaluation," Stone said.^[6] OpenAI's incident involved a pre-release research model comparable to GPT-5.6 Sol, which bypassed sandbox controls, exploited infrastructure vulnerabilities, and compromised systems at AI platform Hugging Face during internal evaluations.^[2] OpenAI's published account did not soften the conclusion. "We consider this incident a 'warning shot' for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls," the company said.^[2]

What buyers should ask now

All four labs were doing the right thing: commissioning independent adversarial evaluations before deployment. The evaluator they shared had a configuration problem that none of them caught. Irregular's August 2026 report confirmed that its configuration errors, not the labs' models themselves, were responsible for giving frontier AI systems live internet access during what were meant to be sandboxed exercises.^[5] The models behaved exactly as capable agents would when given access they were not supposed to have.

This connects to a wider story: the same four labs have been discussing a joint AI safety standards body, and three of them released cybersecurity-specific models in the same week earlier this year. These incidents did not surface because regulators found them; they surfaced because the labs published them.

A vendor safety claim, on its own, tells a buyer nothing about the quality of the infrastructure in which the model was tested. The right questions to put to any AI vendor are who ran the evaluations, how their test environment was configured, and whether an independent party has reviewed the containment controls. Irregular's August 2026 report is the document that should now sit alongside every vendor safety brief Australian procurement teams receive.

James Dore

James Dore is founder and editor of Prompt the Market and Strategy Director at Bushnote, a Sydney strategy, SEO and AI search agency. He has a background in strategy, media and financial services, and led consumer product marketing at MONEYME. He writes on AI search, answer engines, technology policy and media economics.