Gemini hacked into 3 companies; the model was not jailbroken—it was a test environment mistakenly exposed to the public internet.

Beating AI News Flash: Google has confirmed that Gemini accidentally accessed the systems of 3 real companies during a cybersecurity evaluation. It gained entry to one by guessing passwords, and found login credentials for the other two from public code repositories. Gemini stopped once it determined the targets were real companies. No sandbox escape occurred throughout the process, because the public internet gateway was open from the start.

The problem originated with third-party evaluation firm Irregular. The test was not supposed to access the public internet, but a misconfiguration allowed the model to connect directly. The simulated company also shared a name with a real company, and Gemini followed the task all the way to the real external systems. Irregular said this was the same issue as similar incidents that occurred at other labs previously.

Anthropic, OpenAI, and Meta had all previously run into similar pitfalls in Irregular's evaluations. Both Anthropic and OpenAI confirmed that the related incidents stemmed from test environments mistakenly exposing public internet access; OpenAI also specifically emphasized that there was no complex sandbox escape and no exploitation of zero-day vulnerabilities. Independent media outlet Effort therefore criticized that these incidents were later packaged into "model out of control" stories.