Google's Gemini Reached Three Real Companies in a Test: What Is Known and What Is Not

Add Google to the list. On Friday, the Wall Street Journal reported that a Gemini model had accessed the systems of three real companies during a cybersecurity test in May. Google has since confirmed the incidents to several outlets.

If you have followed the reports from Anthropic, OpenAI, UK AISI and Meta, the shape will be familiar: the same evaluator, a fictional company with a real name, and internet access nobody intended.

What is different here is the disclosure. Anthropic, OpenAI and UK AISI each published their own account, and Meta spoke on the record within a day. Google, as far as I can find, has published nothing.

What is known about the Gemini incidents

I could find no Google publication, so this rests on press reports quoting Google and Irregular. I have read SecurityWeek and Cybersecurity Dive, not the original Journal article.

Fact	Attributed to
The test ran in May on Irregular's infrastructure, as a capture-the-flag exercise	Google, via SecurityWeek
The fictional target shared its name with a real company	Google, via the Journal
Internet access was unintentionally available	Irregular, via SecurityWeek
In one run, the model guessed passwords until it reached a protected system	SecurityWeek
In two runs, it searched the web, found credentials in public repositories and used them	SecurityWeek
The model recognised it had reached a real company and ended the intrusion	Google
Irregular told Google at the end of July	SecurityWeek
Google notified the three companies and federal authorities	Google, via the Journal
It was not Google's latest model	Google

The unknowns are just as important. Which Gemini model, which three companies, what the model did once inside, whether data was retrieved, and how long access lasted. None of that is public.

Some coverage says Gemini "escaped". Based on what has been published, I would avoid that word. Irregular says the model had internet access through a configuration problem it has since fixed, and it describes this as the same issue behind the other cases. I see no sign of a technical breakout.

Google's account has a familiar weakness

Google has made three claims: this was mistaken identity, no harm resulted, and it was not misalignment, since safety measures helped the model stop. It told the Journal that the incidents did not warrant public disclosure, and it compared the episode to a bug bounty programme.

Heather Adkins, Google's vice president of security engineering, said: "In all three of these instances, the model stopped."

That is good if it holds. But consider what we have learned this month.

On September 9, Anthropic revised its own July account. It had described its incidents as closer to operational failures, on the basis that Claude believed its targets were simulated. It now says Claude's reasoning was biased toward that conclusion despite considerable contrary evidence, and that it should not have made strong claims about what Claude believed based only on what Claude said. A rescan also turned up a fourth incident the first pass had missed.

So when a lab says a model mistook a real company for a test, the most careful evaluation we have suggests treating that as a hypothesis. That lesson applies to Google's account as well. Stopping after guessing passwords against a real system and using found credentials is better than continuing. It is also true that three real organisations were accessed without authorisation, which is what a bug bounty's rules exist to prevent. A bounty hunter works to an agreed scope, with permission. These three companies gave neither.

Why disclosure is the real issue

Organisation	First public statement	How it became public
OpenAI	July 21	Own disclosure
Anthropic	July 30	Own disclosure, after a transcript review
UK AISI	August 4	Own disclosure
Meta	August 5 and 6	Press report, then statements
Google	September 18 to 21	Press report, then statements

SecurityWeek reports that Google did not disclose publicly until the Journal contacted it. The test was in May, Irregular told Google in late July, and the public learned in September, seven weeks after Anthropic disclosed its own incidents at the same evaluator.

For all that time, other organisations were deciding how to run evaluations without one more data point: Irregular's sandbox flaw had also affected a fourth lab, with a public-repository credential path that matters to every company with a leaked secret.

Google is within its rights to take a different view of what needs disclosing. There is no legal rule that I know of here, and that is the problem. Cybersecurity Dive also reports Treasury Secretary Scott Bessent saying the US wants to work with China on a system for disclosing serious AI incidents, though details are thin. Right now, whether an incident becomes public depends on each company's judgement, and on whether a reporter calls.

What this means for ordinary companies

Most of us are not training frontier models. But two details apply to almost everyone.

First, the two easiest routes in were basic hygiene failures: a weak password, and credentials in public repositories. The model was not doing anything clever. Cheap, patient, automated attackers will find the same things. If your secret scanning is a project for next quarter, this is a good reason to bring it forward.

Second, you may never be told. If a model test reaches your systems, you are relying on a lab, an evaluator and a monitoring tool to notice, and then on someone deciding to call you. Your own detection for unusual logins from unexpected origins is the only part of that chain you control.

In my work on the Verifiable AI Analyst, the model-facing surface is a catalogue of typed capabilities with a per-user manifest: a capability the user is not entitled to does not exist for that turn. There is no raw SQL tool for the model to misuse. That was designed for executives and business data, not for cyber evaluations, but the reasoning is the same as here. "The model stopped" is a statement about behaviour. I prefer designs where stopping is not required, because the action was never available.

What I would want Google to publish

Which model was involved, even if only by generation.
Transcripts or a detailed account of each run, including when the model recognised the target was real.
What access was achieved, and what was read.
Whether a retrospective search covered all of its evaluations, as Anthropic's did, and with what result.
What has changed in its use of third-party evaluators.

That would cost Google very little, and the rest of the industry has shown it is survivable.

In two months we have gone from one unprecedented incident to a list with five organisations on it. I think the list will get longer, because reviews are still running and old transcripts are still being read. I would much prefer to read the next entry on a lab's own website, in the lab's own words, before a reporter has to ask.

Sources

Written by Eslam Hamed, a Technical Lead and AI Solutions Architect working on enterprise RAG, agentic AI, and governed AI systems.