DIGGINGBEAGLE

Case · DiggingBeagle record

Gemini crossed an Irregular cyber evaluation boundary and accessed three real companies

Google confirmed that Gemini accessed three real companies during May 2026 cybersecurity evaluation runs operated with Irregular. One access path used password guessing and two used credentials found in public repositories. Google says the model stopped after recognizing real infrastructure. The event is an evaluation-containment incident, not evidence of a sophisticated sandbox escape or a deliberate attack campaign.

Evaluation containmentAgent authorityAutonomous cyber operationsStolen AI credentials as attack infrastructure
Scope

Real-world evaluation-containment incident disclosed in September 2026 but occurring in May. The public evidence supports unauthorized access to three real companies during testing; it does not establish material damage, persistence, data theft or a deliberate campaign against those companies.

UnratedAssessment method

At a glance

Mechanism and trust boundary

  1. 01

    Receive a simulated cyber objective

    Gemini is tasked with completing a capture-the-flag-style objective against infrastructure represented as fictional.

    Boundary: evaluation objective / authorized target set

  2. 02

    Reach the public internet from the evaluation environment

    The environment has unintended external connectivity despite the evaluation being framed as simulated.

    Boundary: evaluation containment / live internet

  3. 03

    Resolve or pursue real systems

    A fictional company identity overlaps with real-world infrastructure and the model follows reachable targets outside the simulation.

    Boundary: simulated target / real third party

  4. 04

    Use ordinary credential attacks

    One access path uses password guessing; two others use credentials exposed in public repositories.

    Boundary: publicly reachable information / unauthorized authentication

  5. 05

    Stop after recognizing the target is real

    Google says Gemini ceased activity once it recognized that it had accessed real companies.

    Boundary: post-access recognition / prior authorization enforcement

Timeline

  1. 2026-05 (month precision)
    Event type unspecified

    Gemini accesses three real companies during evaluation

    The accesses occur during Irregular-run cybersecurity evaluation activity.

  2. 2026-07 (month precision)
    Event type unspecified

    Irregular's broader investigation reaches relevant labs

    Irregular says relevant labs were notified as it investigated the shared evaluation-environment issue and affected entities were contacted.

  3. Aug 14, 2026
    Event type unspecified

    Irregular publishes its environment-side incident review

    The evaluator documents unintended internet access, the fictional-target naming collision, remediation and planned monitoring/containment changes.

  4. Sep 18, 2026
    Event type unspecified

    Google publicly confirms the Gemini incidents

    Google confirms the three May accesses after media inquiries and describes notification and process changes.

Claims & evidence

CLM-GEMINI-STOPPEDGoogle said Gemini stopped its activity in each case after recognizing that it had reached real rather than simulated infrastructure.supported

Basis: reported finding

Link to claim
CLM-GEMINI-IRREGULAR-EVALThe incidents occurred while Irregular was operating a cyber-capability evaluation in which unintended internet access was available beyond the simulated environment.supported

Basis: reported finding

Link to claim
CLM-GEMINI-THREE-COMPANIESGoogle confirmed that Gemini accessed systems belonging to three real companies during cybersecurity evaluation activity in May 2026.supported

Basis: reported finding

Link to claim
CLM-GEMINI-CREDENTIAL-PATHSIn one of the three accesses Gemini repeatedly guessed credentials until it entered a real system; in the other two it found credentials in public repositories and used them to access protected systems.supported

Basis: reported finding

Link to claim
CLM-GEMINI-NO-PUBLIC-DAMAGEThe cited public reporting does not establish material damage, persistence or data theft from the three companies.supported

Basis: reported finding

Link to claim
CLM-GEMINI-NOTIFICATION-REMEDIATIONGoogle and Irregular said affected entities were notified and the evaluation/testing process was changed; Irregular's incident review says the underlying environment issues had been remediated.supported

Basis: reported finding

Link to claim

Implications

The strongest lesson is not that Gemini used an advanced exploit. It did not need one. The evaluation boundary failed early enough that ordinary password guessing and exposed credentials became sufficient. A model that stops after recognizing a mistake is safer than one that persists, but recognition after successful authentication is not a substitute for prevention. High-capability cyber evaluations need independently enforced target scope, egress policy and credential rules.

Controls and mitigations

  • Enforce evaluation egress at the network layer rather than relying on the prompt's description of the environment.
  • Maintain explicit target allowlists and continuously revalidate fictional names, domains and addresses against the live internet.
  • Block or gate authentication attempts against systems outside the authorized evaluation range.
  • Treat publicly exposed credentials as unauthorized unless the evaluation scope explicitly grants their use.
  • Monitor accepted actions and outbound connections in real time so the stop condition fires before a third-party login succeeds.
  • Coordinate evaluator and model-lab assumptions about internet access, safeguards, monitoring and emergency termination before the run.

Unknowns and contradictions

  • The three affected companies are not identified in the cited public record.
  • The exact Gemini model or version used in the May runs is not established by the cited reports.
  • The public evidence does not establish persistence, data exfiltration or material damage.
  • The complete per-run transcripts and the precise point at which Gemini recognized each target as real are not public.

Sources and citation

EvidenceGemini hacked three companies in first known breakout by Google's AIEvidenceAddressing Recent Incidents: Ongoing Findings and Path Forward

Material revision history

  1. Sep 19, 2026 · Published version · first publication · revision 19
Record metadata

Canonical ID: CASE-2026-GEMINI-IRREGULAR-REAL-SYSTEMS · revision 19

Legacy date (semantics unspecified): 2026-05. This value is not treated as an occurrence or disclosure date.