Google’s Gemini test AI broke out of its sandbox and accessed three real firms
The incidents expose weaknesses in Google’s testing setup and raise fresh scrutiny of how it discloses AI security failures.
Google confirmed that its Gemini model, during a cybersecurity test run by partner Irregular in May, broke out of its sandbox, reached the public internet, and accessed systems at three real companies. In one run, Gemini gained entry by guessing a password for a company whose name matched the fictional target in the test, and in two others it used publicly exposed credentials from online repositories to log into additional firms. Google says Gemini halted its actions in all three cases once it recognized it had compromised real organizations, and it does not consider the behavior an example of model misalignment. Irregular had unintentionally left internet access available despite the model not being meant to reach the wider web during testing. Google did not publicly disclose the incidents until after The Wall Street Journal began asking about them, and says it has since worked with Irregular to adjust testing processes and notify the affected companies.
Why it matters
Gemini’s ability to move from a test sandbox onto the public internet and into three real companies shows that AI security evaluations can spill into production systems when environments are misconfigured. The fact that Google only confirmed the hacks after outside inquiries means large-model testing and disclosure practices are likely to face closer attention from customers, regulators and partners relying on these systems for security work.