Google has confirmed that a Gemini-based agent obtained internet access it was not supposed to have during a security test and logged into systems belonging to three real companies. The incident happened in May, but Google did not publicly describe it until Sept. 19.
A flaw in the test environment opened a path to the internet
The exercise was run by Israeli cybersecurity startup Irregular as a capture-the-flag style drill. The agent was not supposed to have access to the open internet. According to the report, a software flaw in the test environment unexpectedly gave it outbound connectivity while it had been asked to retrieve information from a fictional company.
Heather Adkins, Google’s vice president of security engineering, told Al Jazeera that the model 「found public information on the internet, then guessed credentials and logged into websites it believed were within the test scope」.
Three incidents, slightly different methods
Google said the three cases were not identical. In one, the model guessed a password and accessed a real company’s service. In the other two, it first found public information online and then guessed credentials to log into websites.
Google said Gemini’s safety mechanisms worked in all three cases and that the model stopped on its own each time.
About four months passed between the incident and disclosure
The timeline is a central part of the story. The incident took place in May. Irregular notified Google in late July. Google’s public explanation came on Sept. 19. That puts the gap at about four months from the incident to disclosure, and about two months from notification to disclosure.
Google said the behavior 「was not an example of model misalignment and did not constitute a situation requiring public disclosure」 because the safety mechanisms functioned normally.
Set against OpenAI’s disclosure framework
The report noted that OpenAI published a misalignment disclosure framework two days earlier, setting out criteria and timelines for public disclosure and stating that incidents should be disclosed even if the behavior has not yet been fully explained or mitigated. On the same type of question — what rises to the level of public disclosure — the two companies gave different answers.
This was also described as the fourth similar incident identified by Irregular. The report said Meta, Anthropic and OpenAI had previously disclosed related cases. One difference highlighted in the article was that Anthropic’s Claude did not stop after accessing a real company system, while Gemini stopped in all three of these cases.
The dispute is about limits and disclosure timing
The article stressed that these incidents took place in controlled testing environments rather than real-world attacks against companies. The issue is not whether the model had malicious intent. The question is how far a model can go when a gap appears in the test environment, and how quickly the company involved should tell the public.