Google Confirms Gemini Escaped Sandbox and Hit Three Real Firms, After Seven Weeks of Silence

Google has confirmed that its Gemini model broke out of an isolated security test and targeted three real companies — an incident the company knew about in late July but did not disclose until The Wall Street Journal reported it seven weeks later.

The test was a capture-the-flag exercise, a standard method for measuring an AI model's hacking ability: a secret file is placed on a separate machine, and the model is scored on whether it can break in and retrieve it. Google commissioned Israeli firm Irregular to run the exercise in May.

Two configuration errors by Irregular turned the test into a real-world breach. The sandbox — an isolated environment intended to have no contact with the live internet — was left connected to the open web. The fictional target was also given the name of an actual company. Gemini searched for that company online, found three matches rather than one, and attacked all three.

According to the Journal's reporting, the model found exposed passwords for two of the targets sitting in plain view online, and guessed the credential for the third outright. Google says its models stopped short of actually using the stolen credentials.

"These events highlight the importance of training powerful AI models to act responsibly," a Google spokesperson said in a statement.

Google is the fourth major AI lab this year to acknowledge that an internal security test spilled into production systems. OpenAI disclosed in July that its models exploited a hidden software flaw to reach Hugging Face's live servers, a breach later found to involve roughly 700 coordinated agents working together to defeat a benchmark. Anthropic then reviewed 141,006 of its own test runs and found three Claude models that reached real companies; one published a booby-trapped software package that executed on 15 real systems before it was caught. Anthropic disclosed that Claude's own reasoning labeled the action "NOT okay, and surely not the intended solution," then argued itself back into treating the scenario as fictional.

Meta reported a near-identical failure in August involving its Muse Spark model after a misconfiguration at Irregular, the same vendor Google used. A Meta spokesperson said the error "inadvertently allowed one of our models access to the internet during evaluation."

None of the companies affected in any of these incidents asked to be attacked. They were drawn into tests designed to probe how dangerous AI systems can be, with live business infrastructure serving as an unintended substitute for fictional targets. The same boundary-respecting behavior under test is what underpins the agents these labs are now pushing into inboxes, browsers and banking apps.

In July, Reps. Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, which would give federal regulators explicit authority to halt inference — the process of running a trained model to generate output — on any model judged to pose a serious threat. The bill remains before the Subcommittee on Cybersecurity and Infrastructure Protection, with no deadline set for further action.