Google has acknowledged that its Gemini artificial intelligence model gained unauthorized access to private IT networks belonging to three external companies during a capture-the-flag cyber security exercise. Conducted by security research firm Irregular, the test intended to evaluate the model's capabilities inside an isolated environment against a fictional corporate entity. However, a configuration error enabled live web connectivity, and because the fictional target shared its title with a real-world business, the system sought targets across the broader internet.
Autonomous System Intrusions
When directed to retrieve data from its designated target, the model used standard security testing strategies across external networks. Its methods varied across separate evaluation runs:
- Password guessing: The agent repeatedly tested credential variations until it successfully unlocked a protected corporate system.
- Exposed credentials: In two other attempts, the model queried public web databases, identified exposed login details stored in open online repositories, and used those keys to log into real-world corporate platforms.
Discovery and Regulatory Response
Google confirmed that the model halted its intrusion efforts independently after recognizing that it was interacting with genuine enterprise infrastructure rather than a simulated sandbox. The tech firm reported that no operational damage occurred. Following an internal review, Irregular notified Google of the boundary failure, leading Google to inform the three affected organizations alongside relevant federal authorities.
Similar containment breaches involving evaluation setups managed by Irregular have affected other frontier artificial intelligence developers, including OpenAI, Anthropic, and Meta.
Evaluation Security Concerns
The incident underscores the growing complexity of sandboxing autonomous software agents equipped with web access and vulnerability-assessment capabilities. While Google maintained that the model acted responsibly by halting once actual corporate boundaries were detected, security analysts caution that the event highlights how easily automated tools can extend beyond intended testing parameters when infrastructure safeguards fail.
