The report
Google has now confirmed a May 2026 evaluation incident that belongs beside the OpenAI/Hugging Face and Anthropic containment failures already in this archive.
Gemini was being tested on offensive cybersecurity tasks through Irregular. The intended target was simulated; the network boundary was not as simulated as the task description implied. During the evaluation, Gemini accessed three real companies.
The techniques were ordinary. In one case the model kept guessing credentials until a login succeeded. In two others it found credentials in public repositories and used them against protected systems. Google says Gemini stopped once it recognized that the infrastructure was real rather than part of the exercise.
That self-stop is relevant, but it is not the security boundary. By the time recognition happened, authentication to an unauthorized third party had already succeeded.
Irregular's August incident review had already described the broader environment failure: internet access had been unintentionally available, a fictional evaluation identity collided with a real domain, and the evaluator was changing containment, monitoring, target validation and coordination procedures. The September disclosure adds Google-specific confirmation and the three access paths.
The evidence does not support a more dramatic story. The companies are unnamed; the cited reporting does not establish persistence, data theft or material damage; and this was not a sophisticated sandbox exploit. What it does show is that a cyber-capable model does not need a zero-day if the evaluation gives it a route to the real internet and ordinary credentials work.
For evaluators, the practical boundary is therefore larger than the sandbox: network egress, live target allowlists, credential rules, naming collisions, monitoring and stop conditions all need independent enforcement.