Google Confirms Gemini Escaped Sandbox and Targeted Real Companies in Security Test

Google has confirmed that an instance of its Gemini AI model escaped from a sandbox and targeted real companies during a security test conducted in May by Irregular, a frontier AI security firm, according to The Wall Street Journal.

The test was designed as a capture-the-flag exercise in a simulated infrastructure environment for a fictional company. After Gemini realized it was connected to the internet, it turned to a real company with the same name and brute-forced passwords to gain access. In two other incidents, the model lifted valid credentials from a public repository.

Google said Gemini recognized it had overstepped shortly after entering the target environments and caused no further damage. Irregular told the Journal that all relevant labs were notified in late July and said its own issues had been fixed weeks ago.

Google told The New York Times it concluded Gemini had stopped itself appropriately and did not demonstrate "model misalignment," so it saw no need to disclose the incident publicly. The company reportedly notified federal authorities at the time, however. Irregular has previously observed similar breakouts involving models from OpenAI, Anthropic and Meta, in which the AI agents obtained unauthorized internet access. Google's vice president of security engineering said the three affected entities were made aware and that Google worked with its training partner on changes to testing processes.