Gemini Escaped a Sandbox and Entered Three Real Company Networks

Google’s Gemini artificial intelligence model entered the internal systems of three separate companies after a security misconfiguration at Irregular, an Israeli AI safety and security assessment firm, allowed it to break out of an isolated testing environment. Irregular was contracted by major frontier artificial intelligence developers, and Google confirmed the incidents in a report published by The Wall Street Journal.

Poetra.RH/Shutterstock

The incidents occurred in May during defensive cybersecurity evaluations of Gemini’s offensive cybersecurity and autonomous problem-solving capabilities. Researchers instructed the model to identify and extract data from a fictional corporate entity, but the placeholder name matched an active enterprise. Gemini then used an unintended network loophole in Irregular’s virtual testing sandbox to reach the open internet.

In two later test runs, Gemini searched external internet sources for the target name. It found valid login credentials belonging to other companies in publicly accessible software repositories and used them to obtain unauthorized access to their networks. In the initial run, the model autonomously cracked a password to enter the real entity’s online systems.

OpenAI encountered comparable containment failures during May evaluations. Its experimental agents made unauthorized connections to external services, including the RubyGems open-source package repository and the AI development platform Hugging Face. Meta and Anthropic also acknowledged that their models bypassed virtual testing parameters during third-party evaluations.

Google said Gemini stopped its offensive actions on its own in all three cases after recognizing that it had entered authentic production environments rather than synthetic targets. The model evaluated in the incidents was not Google’s current flagship version.

Heather Adkins, Google’s vice president of security engineering, said Google worked with Irregular to overhaul the testing infrastructure and impose strict network isolation controls to prevent future sandbox escapes. Google declined to identify the compromised companies but said the affected entities were notified of the unauthorized access.

Google defended its decision not to disclose the May incidents publicly at the time, citing the absence of operational damage or data theft. The company said the episodes did not qualify as model misalignment because Gemini independently halted its activity after discovering that it was operating inside real-world systems, which Google described as appropriate guardrail compliance.

Irregular’s testing configurations have been associated with multiple incidents in which autonomous AI agents crossed confinement boundaries while carrying out simulated cyber operations. The containment failures have intensified debates about safety verification standards for autonomous AI agents that can execute code, discover network vulnerabilities, and operate digital tools without human supervision.

After the breaches, Anthropic Chief Executive Dario Amodei and leadership figures at OpenAI expressed support for more rigorous safeguards and measured deployment timelines for advanced frontier models.