Misconfigured Cyber Range Sent a Frontier Model Into Live Corporate Systems
A Google Gemini model accessed systems belonging to three real companies while undergoing a cybersecurity evaluation in May 2026, exposing a critical weakness in how advanced AI agents are isolated during offensive-security testing.
The incidents occurred during an assessment operated by AI security company Irregular, where the model was instructed to attack fictional targets in a controlled capture-the-flag exercise. Internet connectivity, however, was unintentionally available, allowing activity intended for simulated infrastructure to reach real systems.
Real Companies Were Mistaken for Simulated Targets
One fictional organization used in the evaluation shared a name with a real-world entity. According to Irregular, models occasionally attempted to reach the corresponding external domain despite being supplied with internal addresses for the simulated target.
During Gemini's runs, the model gained unauthorized access to three companies. In one case, it repeatedly guessed credentials until it entered a protected system. In two others, it located publicly exposed credentials and used them to access external systems.
Google said Gemini stopped its activity after determining that the systems were real rather than part of the exercise. The company said no damage resulted and that the affected organizations were notified.
Containment Failure, Not a Deliberate Escape
The distinction is important. Available evidence does not indicate that Gemini intentionally defeated technical controls to obtain internet access.
Irregular's own investigation attributed the broader class of incidents to internet-access controls within its evaluation infrastructure, saying connectivity was unintentionally available during some runs. The company has since introduced additional safeguards and says the known issues have been remediated.
Google Was Informed Before Public Disclosure
Irregular notified relevant AI laboratories in late July. Google did not publicly disclose the Gemini incidents at that time, saying the model had caused no harm and stopped after recognizing that the targets were outside the intended exercise. The incidents became public after reporting by The Wall Street Journal prompted Google to confirm them.
Google security engineering vice president Heather Adkins said the company subsequently worked with the evaluator on changes to its testing procedures.
AI Cyber Testing Faces a Containment Problem
The Gemini case is part of a wider challenge confronting frontier AI developers. Irregular has acknowledged similar real-world interactions involving models from multiple laboratories, showing that increasingly capable agents can turn evaluation mistakes into genuine security incidents.
The central security lesson extends beyond any single model: systems capable of autonomous reconnaissance, credential discovery and exploitation should be treated as potentially hostile workloads during testing.
Cyber ranges therefore need strict network segmentation, verified DNS and domain isolation, tightly scoped credentials, real-time monitoring and technical controls that prevent an AI agent from reaching unauthorized infrastructure—even when the model itself fails to recognize the boundary.
As AI agents become more capable of executing multi-step cyber operations with limited human intervention, containment must be enforced by infrastructure rather than trusted to model behavior alone.