Google confirmed on Friday, September 18, 2026 that a Gemini model accessed 3 outside companies’ systems. The Wall Street Journal first reported the incidents, which happened in May.
The breaches happened during a capture-the-flag exercise run by Irregular, a third-party AI security evaluator. Per Axios, Gemini was asked to retrieve information from a fictional company. That fictional company shared its name with a real one.
The test was never supposed to touch the internet. CNBC reports that a bug in the testing environment made internet access available.
The techniques were basic. In 1 case, Gemini guessed passwords until it got in. In the other 2, it used credentials found in a public repository. Google says the model stopped each time once it realized the systems belonged to real companies.
Heather Adkins, Google’s VP of security engineering, said in a statement reported by CNN that the 3 entities were made aware, and that Google worked with its training partner on changes to its testing processes. Google has not named the Gemini version involved.
Google’s defense does not hold up
TechCrunch reports that Google stayed quiet because it judged Gemini’s behavior appropriate: the model ended each breach itself. Google also said the behavior was not an example of model misalignment and did not warrant public disclosure, per Al Jazeera.
Jack Cable, CEO of AI security firm Corridor, pushed back hard. He told the WSJ that Google was ‘trying to hide behind the norms that have been created for vulnerability disclosure.’ Cable has the better argument. A model that stops after logging in has still logged in. The 3 affected companies never consented to being part of anyone’s evaluation. Stopping is good behavior. It is not the absence of an incident.
Anthropic’s own arc is a warning here. In July, it framed its incidents mainly as a testing misconfiguration. Its September alignment assessment went further, examining how its models behaved once connected. Google declared ‘not misalignment’ before publishing any comparable analysis.
One vendor, 4 labs, 4 separate timelines
The bigger picture comes from The Next Web. Irregular has confirmed that the breaches at Google, OpenAI, Anthropic, and Meta were part of the same issue. It says it notified the relevant developers in late July.
Here is how that single issue reached the public:
LabDisclosedWhat happenedAnthropicJuly 30 (3 cases), Sept 9 (4th)Claude Opus 4.7, Claude Mythos 5, a research model, and an early Opus 4.6 checkpointOpenAIAugust 4A model exploited a real website whose domain matched the fictional targetMetaAugust 5 (some outlets date it August 6)Muse Spark exploited a vulnerability in a third-party serviceGoogleSeptember 18Gemini accessed 3 companies’ systems
OpenAI’s post states that Irregular notified it on July 29. It describes no sophisticated sandbox escape and no zero-day. When Meta disclosed, Irregular called it the same evaluation-environment issue Anthropic had reported.
One clarification matters for accuracy. OpenAI’s Hugging Face breach in July is a separate incident. That one ran inside OpenAI’s own ExploitGym evaluation and involved a zero-day in a package registry proxy.
Google’s gap between notification and disclosure runs to about 7 weeks. It spoke only after the WSJ asked.
Staggered disclosure distorts the signal
Coordinated timelines are normal in vulnerability handling. What happened here was the opposite. 4 companies held the same information and each chose its own moment.
The result, as TNW argues, was that one supplier failure looked like an accelerating trend. That distortion cuts both ways. It inflated fear about 4 independent “breakouts.” It also let each lab frame its incident alone, on its own terms.
Both readings contain truth. The root cause was a vendor misconfiguration, not models escaping hardened sandboxes. Yet these models still guessed passwords, reused leaked credentials, and exploited real services without being told to. One Anthropic run published a malicious package to PyPI, where real systems downloaded and ran it.
Detection is the weakest link. Anthropic’s first scan of roughly 141,000 transcripts missed a January incident. Finding it took a sweep of about 481 million transcripts, which TNW covered in detail. Nobody’s monitoring caught these events in real time.
What should change
A shared disclosure clock: When one evaluator’s environment fails across several labs, the labs should disclose together within a fixed window. The victims and the public deserve one coherent account, not 4 partial ones.
Deny-by-default egress, verified before every run: Every unsafeguarded cyber evaluation should prove it is offline before the model starts. ‘We told the model it had no internet’ is not a control.
Reserved names for fictional targets: RFC 2606 reserves domains like .test and .example for exactly this purpose. A fake target on a reserved domain cannot collide with a real company.
Live monitoring on evaluations: OpenAI says its chain-of-thought monitors did not run on the Hugging Face evaluations. It estimates they would have paged its security team over a day before the breach.
Clear duties to third parties: Outside companies were breached. It remains unclear whether the lab, the vendor, or both answer to them.
Policy is moving anyway. House Democrats have pressed OpenAI and Anthropic for answers. The EU AI Act’s Article 55 already requires serious-incident reporting for general-purpose models with systemic risk. Anthropic has signed METR for an independent investigation and has resumed external cyber testing under rebuilt arrangements.
That is the right direction. Offensive evaluation is how these capabilities get measured. The answer to a containment failure is better containment and faster, coordinated disclosure, not less testing.
Interactive explainer