Gemini Guessed a Real Company's Password in May. Google Confirmed It in September, After a Reporter Asked.

Sometime in May, a Google model sat inside what it believed was a sealed hacking range, was handed a fictional company to break into, and did what it was told. It found a real company with the same name on the open internet, guessed its way past a password prompt, and got in. Twice more it did the same thing with credentials it scraped from a public code repository. Google learned about it in July. The public learned about it on Friday, September 18, after The Wall Street Journal asked.

Google confirmed the three incidents the same day. Heather Adkins, the company's vice president of security engineering, framed the episode as evidence of safeguards working rather than failing. "Safe development of powerful AI models is critical and we invest deeply in this area," she said in a statement, adding that her team had contacted the affected entities and "worked with our training partner on the changes they've now made to their testing processes."

That training partner is Irregular, the Tel Aviv-based evaluation firm that has now been the common denominator in unauthorized-access disclosures from OpenAI, Anthropic, Meta and Google. Its test environment was supposed to be air-gapped. It was not. An Irregular spokesperson told Axios the Gemini incident "involved the same security issues" as the others, that all "relevant labs were notified in late July," and that "all known issues on our end were remedied and resolved weeks ago."

How Gemini Got In

The exercise was a standard capture-the-flag evaluation: Gemini was asked to retrieve information from software run by a made-up company inside a sandbox. The sandbox had live internet access that the model had been told it did not have, and the made-up company shared its name with a real one. Gemini resolved the ambiguity the way an attacker would. In the first case, it iterated password guesses against a protected service until one worked. In the second and third, it located login credentials sitting in a public repository and used them to authenticate to other protected systems.

Adkins told Al Jazeera that in those later instances "the model found public information online and guessed credentials to access websites it thought were part of the test." Google says that in all three cases the model stopped once it recognized the target was real, that no damage was done, and that the behavior was not misalignment. On that basis, the company decided the incidents did not warrant proactive public disclosure.

Google was not aware of the intrusions until July, according to NBC News, when Irregular audited its own test logs after OpenAI's models accessed Hugging Face's systems during a similar run. That puts the timeline at roughly two months from intrusion to Google's knowledge, and roughly seven more weeks from Google's knowledge to public confirmation, which came only after a reporter's inquiry. Android Headlines, citing The Guardian, reported that Google did notify federal authorities during that window.

The victims have not been named. Google says they were contacted. Whether Gemini read, copied or retained anything inside those systems before it stopped has not been disclosed by Google, Irregular or anyone else.

Why It Matters

Four labs, one vendor, at least seven outside organizations accessed without permission. The specific failure is mundane: a network isolation misconfiguration on a contractor's infrastructure, combined with a prompt that named a fictional target with a real-world doppelganger. But the mundane failure is the point. The industry's argument for why autonomous cyber-capable models are safe to test rests on the sandbox. If the sandbox is a shared third-party environment with an unintended route to the internet, the safety case is only as good as the vendor's firewall rules, and Irregular's were wrong for at least four separate clients across a span of months. Axios reported earlier this summer that the labs and Irregular were never fully aligned on what the isolation guarantees actually were.

Google's "the model stopped" defense deserves scrutiny on its own terms. Stopping after a successful brute-force login means the credential was already compromised and the session already established. A model that recognizes its mistake after authentication has still authenticated. Anthropic's Claude, by contrast, did not stop when it hit real systems in its own Irregular incident, which is a meaningful difference in model behavior but not a difference in whether the victim was breached. Google is effectively arguing that a better-behaved burglar is not a burglar.

Then there is the calendar. OpenAI, after its own Irregular-linked incidents and a Senate inquiry from Josh Hawley into the Hugging Face intrusion, published a disclosure framework on September 16 committing to report incidents "ready for disclosure" within six business days and those requiring investigation within twelve. Google's equivalent number is roughly 120 days from the event and zero voluntary disclosures. Google's position is that its safety measures worked so there was nothing to disclose. That standard, applied generally, means no lab ever has to tell anyone about an incident it considers contained, and it leaves the accessed companies dependent on the good faith of the party that accessed them.

What to Watch

The unanswered questions are concrete. Who were the three companies, and do they agree with Google's characterization that the model stopped before anything of consequence happened? Has Irregular disclosed every incident in its client base, or only the ones that reached reporters? Whether Google adopts a fixed disclosure clock comparable to OpenAI's will say a lot about whether Friday's confirmation was a policy or a reaction. And with Hawley's investigation already open and OpenAI's framework setting a de facto benchmark, the next test is whether regulators treat a contractor's sandbox failure as the lab's responsibility, or let the industry keep grading its own containment.