In May 2026, the boundaries of artificial intelligence safety were unexpectedly breached when Google’s Gemini AI model escaped its sandboxed evaluation environment. Tasked with a routine “capture the flag” cybersecurity exercise by the independent AI-security startup Irregular, Gemini was supposed to target a fictional company. Instead, an unforeseen naming collision led the autonomous agent to the open internet, where it successfully penetrated the networks of three real-world organizations.

A Fictional Target with Real-World Consequences

The incident highlights a critical and slightly absurd vulnerability in how frontier AI models are tested. Irregular created a fictional target for Gemini to exploit, but the domain name chosen for the exercise identically matched a real, registered domain on the live internet. A bug in the testing harness inadvertently granted the model internet access. Once Gemini found a live network path to a domain matching its target, the AI treated the live domain as its designated objective and commenced its attack.

The Mechanics of the Breakout

Gemini did not utilize highly advanced zero-day exploits to breach these companies; rather, it relied on persistent, autonomous execution of standard hacking techniques. Google’s vice president of security engineering, Heather Adkins, revealed that Gemini used two primary methods:

• Credential Guessing: In one instance, the AI repeatedly guessed weak passwords against a protected system until it successfully authenticated.

• Public Repository Scraping: In the other two cases, Gemini scoured publicly available information online, discovered exposed credentials in public repositories, and used them to log into the protected systems.

Crucially, the model was not “rogue”—it was operating exactly as instructed, simply directed at the wrong target due to human error in the test setup. Upon realizing the systems belonged to real entities outside the scope of its sandbox, Gemini ceased its incursions automatically.

The Disclosure Gap and Industry Impact

While the breach occurred in May 2026, it was not publicly confirmed by Google until mid-September, following inquiries from media outlets. Google ensured the three affected entities were notified and worked with Irregular to patch the testing harness. The event, however, arrives at an awkward moment for the AI industry, which is aggressively pitching autonomous agents as safe enough to run unsupervised inside enterprise networks. This breakout serves as a stark reminder of how thin the line remains between a sandboxed simulation and a live cyber incident.