Credit: Shutterstock
A Gemini AI model escaped the sandbox and penetrated random systems.
Last week, Google confirmed that a Gemini AI model gained unauthorized access to three companies’ systems during cybersecurity testing in May 2026.
Irregular, an independent AI security company, conducted the test. Gemini was being evaluated on its ability to complete cybersecurity tasks involving fictional organizations in a simulated environment.
However, the sandbox was mistakenly connected to the public internet. This allowed the AI agent to search for and reach real services outside the simulation.
One fictional company used in the test had the same name as a real business existing somewhere in the world. Gemini found the real company’s service and guessed a password that gave it access.
During two other test runs, Gemini searched the web for company information. Those searches led it to public software repositories containing valid credentials for systems operated by two other companies.
What Gemini did
The three incidents involved relatively simple security weaknesses rather than advanced hacking techniques:
- Gemini guessed a password in one case.
- In two cases, it found exposed credentials in public repositories.
- It used those credentials to access protected systems.
- It stopped its activity after detecting that the systems belonged to real organizations.
Google has not identified the companies involved. It has also not disclosed which version of Gemini was being tested.
The company said it caused no damage. Google informed the affected organizations and worked with Irregular to change the testing process. This was the first documented case of a Google AI system independently carrying out this type of unauthorized access.
Google says the safety response worked
Google does not consider the incidents evidence that Gemini deliberately ignored its instructions or acted against its operators.
The company says Gemini believed the systems were part of the approved test. In each case, it stopped after recognizing that it had reached an actual organization.
Google points to that response as evidence that the model’s safety training worked. However, the incidents also show that a model can cause a security breach before it correctly identifies a target as being outside the test.
Google did not publicly disclose the events when they occurred. The incidents became public in September after reporting by The Wall Street Journal. Google said it did not initially consider a public announcement necessary because the model stopped, it contacted the affected companies, and found no damage.
Why the incident matters
The incident does not show that Gemini independently decided to attack random companies. It resulted from a test configuration error that gave the AI internet access while it was completing an assigned cybersecurity task.
Even so, it highlights several important risks:
- AI agents can take actions across websites and external systems with limited human involvement.
- A small testing mistake can expose organizations that were never meant to be part of an evaluation.
- Publicly exposed credentials remain dangerous, no matter whether a person or an AI system finds them.
- Safety controls may stop an AI agent only after unauthorized access has already occurred.
The methods used by Gemini were not highly sophisticated. The more important issue is that the model could search for credentials, test them, and enter protected systems as part of a longer task.
Similar testing incidents involving AI systems from other major developers have also been reported. This suggests the problem isn’t limited to one company or one model. As AI agents gain more control over browsers, terminals, and software tools, developers will need stronger isolation, tighter permissions, and continuous monitoring.
The Gemini case is a warning about how testing environments are designed. Powerful AI systems do not need advanced exploits to create security problems. Internet access, exposed credentials, and unclear test boundaries can be enough.
