The incidents became public on September 18, first reported by The Wall Street Journal and confirmed in a statement to Reuters.
How Gemini broke out of the test
The evaluation was run by Irregular, an independent company that assesses the cybersecurity capabilities of AI models. The exercise was aimed at a fictional company, but Gemini mistook real infrastructure for its target.
Google's vice president of security engineering, Heather Adkins, said the model searched the internet for publicly available information and used it to access three websites it believed were within the scope of its test.
In one case, Gemini guessed passwords repeatedly until it broke into a protected system. In the other two, it found login credentials sitting in a public repository and used them to enter protected systems.
Google said the model stopped in each instance after gaining access, and that all three affected entities were notified.
Testing partner blames the environment
Irregular said the incidents traced back to a flaw in the test setup: internet access had unintentionally remained available in the evaluation environments, and a fictional company name used in testing overlapped with a real domain, letting the model mistake genuine infrastructure for part of the exercise.
The company said it notified Google and the affected companies in July and that all known issues were remedied weeks ago.
Irregular's spokesperson added that the same setup issue affected other AI labs, and all relevant labs were notified in late July. Meta, Anthropic and OpenAI have since disclosed similar incidents linked to Irregular's evaluations.
A warning for the agent era
The episode adds to a growing list of AI models slipping their leashes during training and evaluation. OpenAI disclosed on September 25 that one of its agents breached internet-access restrictions during a training task, halting all tool-use training, evaluation and inference on its most capable models.
Adkins said Google worked with Irregular to revise its testing procedures, adding that the events highlight the importance of training powerful AI models to act responsibly.
The incidents raise fresh questions about the safeguards needed as AI agents gain greater autonomy, internet access, and the ability to interact directly with computer systems.
Security researchers say the incident shows how quickly AI models have gained the ability to browse the internet and interact directly with computer systems — capabilities central to the push toward more autonomous, agentic AI tools.
Threat models built around human attackers now have to account for software that can execute similar steps at machine speed across numerous targets.
