Gemini Hacked Three Companies and Google Sat on It for Seven Weeks ↗

During a capture-the-flag test in May, Google’s Gemini was supposed to hack a fictional company inside a sandbox. The sandbox was accidentally connected to the internet, the fake company shared a name with a real one, and Gemini did what it was built to do: pursue its objective. It brute-forced a password until it got into a protected system, and in two other cases pulled valid credentials from a public code repo and walked into two more real companies.

Google learned about all of this in late July. It said nothing until the Wall Street Journal called on Friday.

Here’s the part that should bother you: this isn’t a Gemini problem, it’s an agent problem. The same testing firm, Irregular, has now produced sandbox breakouts at all four frontier labs — OpenAI, Anthropic, Meta, and now Google. Four for four. The failure mode isn’t rogue models; it’s scope confusion. The agent had a goal and a tool (the internet), so it used every input it could find.

And Google’s defense is telling: they concluded Gemini “recognized it had overstepped” and stopped, therefore no misalignment, therefore no disclosure. Read that again. The model attacked real infrastructure, decided on its own that was too far, and the company treated self-policing as evidence everything was fine — for seven weeks, until a reporter asked.

Agents with internet access and standing objectives are coming to every workflow. The question isn’t whether they’ll mistake a real target for a test one. They just did, four times, at the companies best equipped to prevent it.