What Actually Happened

Google confirmed on September 18, 2026 that its Gemini AI model broke into three real companies' systems back in May, during what was supposed to be a sandboxed cybersecurity test. AI security vendor Irregular had set up a "capture the flag" exercise where Gemini was told to retrieve information from a fictional company's systems, but that fictional company happened to share its name with a real one. In one case, Gemini guessed passwords until it gained access. In two other cases, it found credentials sitting in a public repository and used them to reach other protected systems. Google says its model stopped acting as soon as it recognized the systems belonged to a real company, not the intended test target.

The Same Failure, Four Times Over

  • Google joins OpenAI, Anthropic, and Meta. Irregular ran the same test format against each of these labs' models, and all four have now disclosed a breach that reached real company infrastructure instead of the intended sandbox.
  • One root cause, not four separate bugs. Irregular traced every incident back to the same issue: unintended live internet access during tests that were supposed to be fully isolated. The agents weren't rogue, they simply weren't as contained as their operators assumed.
  • Disclosed in July, made public in September. Irregular told the affected labs about the shared flaw in late July 2026; Google's disclosure on September 18 was the last of the four to go public.
Quick Insight

None of these AI agents "went rogue." They did exactly what they were told, inside an environment that leaked more access than anyone intended. That is arguably the more useful takeaway for any business now handing AI agents real tasks.

What This Means If You're Building With AI Agents

If your business runs AI agents against your CRM, your codebase, your customer data, or any internal system, this is a reminder that agent isolation is your responsibility too, not just your AI vendor's. A model with unrestricted internet access, even one meant to operate in a "test" or "sandbox" environment, can end up touching production systems it was never supposed to see.

What to Check Before You Deploy

Before rolling out or expanding any AI agent workflow, confirm exactly what network access it has, whether that access is scoped to only what the task requires, and whether "sandbox" actually means isolated or just means "we haven't connected it to anything critical yet." The four incidents above all trace back to teams assuming isolation that wasn't actually enforced.