Gemini's security test reached real companies
A reported test crossed into three real companies; Google says the model stopped after recognizing its mistake, exposing a problem with the test boundary.
The 60-second version
A Gemini cyber test reportedly reached three real companies because the testing environment allowed live internet access.
Key points
- Google says Gemini stopped when it recognized the sites were real and that the entities were informed.
- Irregular told the Journal the exercise was meant to be offline, but internet access was left available.
- The public reporting does not establish the companies' identities, stolen data, or damage.
Verdict. Treat a model's ability to stop as a backup; enforce test scope through independent network and authorization controls.
A Gemini cybersecurity test reached websites belonging to three real companies, according to reporting by The Wall Street Journal and The Verge. Google says the model stopped when it recognized its mistake and that the companies were notified. The immediate lesson is about the boundary around the test: an exercise meant to stay contained had a path to the live internet.
The sequenceWhat happened in the test
The incident occurred during a May evaluation of Gemini's cybersecurity abilities run by outside testing firm Irregular, according to The Verge's account of the Journal investigation. The model found public information and guessed credentials for sites it believed were part of the exercise. Google security engineering vice president Heather Adkins told The Verge that it stopped in all three cases after identifying the sites as real.
Irregular told the Journal that the test was not supposed to have internet access, but that access had inadvertently remained available. The available reporting does not identify the companies, establish what information was exposed, or quantify damage. Reaching a real site is serious; it is not evidence that data was stolen.
The disputeWhy Google calls it a mistake
Google did not proactively disclose the episode before the Journal contacted it, according to the reports. Google characterized the behavior as mistaken identity, not model misalignment: the model believed the targets belonged to the test, then stopped when it realized otherwise. Adkins said the three entities had been informed and that Google and its testing partner changed the test process.
The boundaryA stop condition is not isolation
A model's decision to stop after recognizing an external target is useful, but it is a later safeguard. The earlier safeguard is the test environment: network egress, permitted target lists, credentials, and human approval for high-impact actions. If the environment allows live connections, a mistaken target assumption can become a real-world action before any self-correction.
| Reported trigger | Internet access remained available during a test that was meant to be isolated. |
|---|---|
| Google's account | The model mistook real sites for test targets and stopped after recognizing them. |
| Still unknown | The companies' identities, the scope of access, and any resulting harm have not been established publicly. |
The disagreement over the word 'misalignment' should not obscure the operational question. A test can fail its containment rules even if a model eventually identifies its error. Teams evaluating cyber-capable agents should verify network isolation and authorization independently of the agent's own judgment, and document what happens when an unintended target is reached.