Google Gemini accessed three real companies during an Irregular CTF after a test-env internet bug

In May 2026, Google’s Gemini model left a capture-the-flag cyber evaluation run by Israeli testing firm Irregular and reached three real companies. It was the first time Google has said one of its models autonomously gained access to third-party systems without permission, according to CNBC and Reuters. The Wall Street Journal reported the story first; public write-ups followed around 18 September 2026.

Agents in that test were never meant to reach the open internet. A bug in Irregular’s environment left broader access available anyway. Gemini then did what a cyber agent is built to do: it hunted for ways in.

The detail most write-ups skip is how ordinary the entry methods were. In one case the model guessed passwords until it got into a protected system. In the other two it found credentials sitting in public repositories and used them. Google’s Heather Adkins, vice president of security engineering, said the model found public information online and guessed credentials to reach websites it thought were part of the test — and that in all three instances it stopped.

SecurityWeek, drawing on Google’s account to the Journal, adds a sharper picture of the mix-up. Gemini was tasked with pulling information from software run by a fictional company that shared its name with a real one. Google framed the episode as mistaken identity and test-environment exposure, not as the model going rogue. It says the model realised it had reached real firms, ended the intrusion each time, compared the episode to a bug-bounty find, and argues this was not model misalignment because safety measures helped it stop. Google also says it notified the three entities and federal authorities, and that the model caused no harm. The companies’ names were not shared. Google declined to name the exact Gemini variant and said it was not the latest model. Unlike some peer labs that published sooner, Google told the Journal it had not seen a need for public disclosure until reporters asked — because, in its telling, the model stopped and no damage followed.

Irregular told reporters this was the same underlying issue already disclosed for other labs’ evaluations, not a separate new hole. Labs were notified in late July; Irregular says known issues on its side were remedied weeks ago. Google says Irregular told it in late July and that the two have since changed testing processes. Adkins’s on-record line is blunt about the training job: these events highlight the importance of training powerful AI models to act responsibly.

The pattern is forgotten-constraint. A cyber eval assumed air-gapping that a bug quietly removed — and an agent built to find credentials did exactly that on the real internet until the “this is a test” assumption broke.