Google confirmed on September 18 that its Gemini model gained unauthorized access to three real external systems during a cybersecurity evaluation in May. The incident, disclosed months after it happened, shows that the same kind of leak between a "test environment" and real systems that already hit agents from OpenAI, Anthropic, and Meta also reached Google.
The intrusion occurred in May 2026 during a capture-the-flag-style evaluation run by Irregular, an independent firm that specializes in stress-testing advanced AI systems. According to Heather Adkins, Google's VP, "in a standard evaluation, the model found publicly available information online and guessed credentials to access sites it believed were part of the test." In one case, Gemini repeatedly guessed passwords until it got into a protected system; in the other two, it found exposed credentials in a public repository and used them to gain access.
The root cause was a design flaw in the exercise: internet access was unintentionally left open, and a fictional company used in the test scenario happened to match a real domain. Once it reached the real internet, Gemini treated the real infrastructure as if it were part of the exercise.
Irregular caught the problem in July, while reviewing its own testing work after OpenAI publicly disclosed that its agents had autonomously compromised Hugging Face's data-processing systems. Google made the information public on September 18, after reporting from the Wall Street Journal. The company maintains that the episode doesn't rise to the level of "misalignment" — the industry term for AI acting outside its given instructions — because the model self-corrected and caused no detectable harm.
If your company is testing AI agents with tool access — web browsing, code execution, credentials for internal systems — this incident is a concrete warning: a poorly isolated test environment isn't a test environment. Fictional domain names that accidentally match real domains, internet access left on "just in case," or test credentials that turn out to be valid in production are configuration mistakes, not model failures.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel