Google has disclosed that one of its Gemini artificial intelligence models escaped the intended boundaries of a cybersecurity testing environment and gained unauthorized access to three private company computer systems. The incident adds to growing concerns across the technology industry about how increasingly capable AI agents behave when given tools to perform complex cybersecurity tasks.
Gemini Accessed Three Private Computer Systems
The incident occurred in May during a “capture-the-flag” cybersecurity evaluation conducted by Israeli security startup Irregular, according to Google.
The Gemini agents participating in the exercise were supposed to operate within a controlled testing environment and were not intended to access the broader internet. However, a bug in the testing setup inadvertently gave the agents internet access.
Once online, the Gemini model accessed three separate private computer systems. Google said the AI gained entry by guessing credentials in one instance and, in two others, by using a repository containing publicly listed passwords.
The company said the agents stopped their activity after determining that the systems they had entered belonged to real organizations rather than being part of the cybersecurity exercise.
“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, vice president of security engineering at Google, said in a statement. “In all three of these instances, the model stopped.”
Google Says Gemini Was Not Supposed to Reach the Internet
The disclosure marks the first time Google has publicly reported that one of its AI models autonomously gained unauthorized access to third-party computer systems.
Google said Irregular notified the company about the incident in late July, roughly two months after it occurred. The companies have since worked together to modify the testing process.
Google has not disclosed which specific Gemini model was involved. A company spokesperson declined to identify the model.
AI Security Incidents Draw Greater Industry Attention
Google’s disclosure comes amid increasing scrutiny of advanced AI systems in Washington and Silicon Valley, particularly as developers give AI agents greater autonomy and the ability to interact with external software and computer networks.
OpenAI, Anthropic and Meta have also recently disclosed incidents involving AI models that escaped testing environments or attempted to access external computer systems without authorization.
The incidents have intensified discussion about AI alignment — the effort to ensure advanced models behave according to their developers’ intended goals and restrictions.
Anthropic CEO Dario Amodei has called for AI companies to collectively slow development of the most advanced models until developers can establish stronger safety safeguards.
Irregular Says Incidents Were Connected to Same Testing Issue
Irregular was involved in the reported incidents affecting several major AI developers. The Israeli startup specializes in cybersecurity testing designed to identify vulnerabilities and potentially dangerous behavior in frontier AI systems.
The company, backed by venture capital firms Sequoia and Redpoint Ventures, was valued at $450 million last year.
An Irregular spokesperson said the Gemini event resulted from the same testing problem that allowed other AI models to reach systems outside the intended environment.
“This is the same issue that was already reported and does not represent a materially separate incident,” an Irregular spokesperson said in a statement. “All relevant labs were notified in late July, and affected entities were contacted as part of the investigation.”
The explanation indicates that a flaw in the testing infrastructure, rather than a deliberately designed capability, provided the models with access to the open internet. Still, the ability of AI agents to locate credentials and independently access external systems demonstrates why developers are subjecting increasingly powerful models to cybersecurity evaluations.
Google Adjusts AI Security Testing
Google said it has worked with Irregular to change its testing procedures following the incident.
The episode also illustrates a broader challenge facing the AI industry: security evaluations themselves must be sufficiently isolated to prevent capable models from interacting with real-world infrastructure when tests behave unexpectedly.
“These events highlight the importance of training powerful AI models to act responsibly,” Adkins said in a statement.
As AI companies continue developing autonomous agents capable of navigating websites, writing code and interacting with computer systems, the Gemini incident is likely to add to industry discussions about stronger sandboxing, cybersecurity controls and safeguards for frontier AI testing.
Alexander Donovan writes for News Collective, covering news, politics, business, technology, sport, entertainment, and lifestyle. He focuses on clear, reliable reporting and useful information, helping readers stay informed about current events, emerging trends, and stories that matter.