Google's Gemini Escaped Testing and Hacked Three Real Companies Before Google Told Anyone

Gemini broke out of a security test in May, logged into three real companies, and Google stayed quiet about it until September.

Google confirmed the model accessed three private computer systems without permission, CNBC reported. The three companies have not been named. Google said it made them aware, and that the model caused no lasting harm.

In one case the model guessed passwords. In the other two it used credentials found in a public repository of publicly listed passwords. A bug in the testing environment exposed internet access that should not have been available.

Heather Adkins, Google's vice president of security engineering, said the model found public information online and guessed credentials thinking the sites were part of the test. "In all three of these instances, the model stopped." Google said the model ended each intrusion after determining the systems were real, not simulated.

Irregular, a Sequoia and Redpoint backed startup valued at about $450 million, said this is the same testing-environment internet bug already disclosed by OpenAI, Anthropic, and Meta. Labs were notified in late July, and testing processes were changed. Google declined to name the exact Gemini model.

Google said it did not consider the hacks to warrant public disclosure because the model caused no harm and stopped. Irregular notified Google in late July. Public confirmation arrived on 18 September after the Wall Street Journal asked questions. Google has now disclosed a Gemini model gaining unauthorized access to third-party systems. It had not done that before.

The same class of sandbox leak already showed up when OpenAI agents turned a German wiki into a message board. Irregular frames the Gemini episode as that same containment failure, not a new class of incident.