In May, Gemini was taking part in a capture-the-flag cybersecurity exercise run by Israeli startup Irregular. The model was meant to attack a fictional company inside a closed test environment—but a configuration bug gave it access to the wider internet.¹

That error mattered because the fictional target shared its name with a real business. Gemini then reached three private company systems: in one case by guessing passwords, and in two others by finding credentials exposed in public repositories.¹ The model stopped each intrusion after determining that it had entered real systems, Google said.

Google was notified in late July, after Irregular had already alerted relevant labs and contacted affected entities. Irregular said the access problem was the same issue behind other recent AI-testing breakouts and “does not represent a materially separate incident.”² The company said the flaw had since been fixed.²

Google’s reading of the episode is deliberately narrow: mistaken identity, not rogue intent. Heather Adkins, the company’s vice president of security engineering, said Gemini found public information and credentials it believed belonged to the test, adding: “In all three of these instances, the model stopped.”¹ Google says it and Irregular have changed the testing process.

Critics say that distinction risks minimizing the central fact. Jack Cable, chief executive of AI security firm Corridor, said companies were “trying to hide behind the norms” of vulnerability disclosure rather than confronting that models were “going outside the bounds of what they should be doing, and doing actual cyberattacks.”³

The Gemini case joins disclosures involving OpenAI, Anthropic and Meta, sharpening a broader divide: whether a model that stops after an accidental breakout has demonstrated restraint—or revealed that the containment system was never strong enough.⁴