Test sandbox failed to contain Gemini: the model hacked 3 real companies

Gemini then went online and logged into the systems of three real companies. Google was running cyber exercises in May 2026, and the test setup was not supposed to have internet access: test partner Irregular in Tel Aviv mistakenly left the connection open.

The same contractor tests models from OpenAI, Anthropic and Meta for dangerous capabilities. Over the summer, all three reported sandbox escapes.

**Credentials were sitting in open repositories.** In the first case, Gemini figured out the password to a company service on its own. In the other two, it found other people's usernames and passwords in public repositories and used them to log in.

In all three cases, the model stopped on its own after realizing it was breaking into something other than a simulation. Google does not consider this model misalignment, and the companies suffered no harm. Heather Adkins, Google's vice president of security engineering, says all three companies were notified and that the testing process with Irregular was redesigned.

A disclosure gap. The breaches happened in May, Irregular told Google in late July, and the news became public on September 18–19, according to Google speaking to WSJ.

Anthropic's own testing produced 3 incidents across 6 evaluation runs. Claude Mythos 5 uploaded a malicious package to PyPI, and within an hour it was downloaded and run on 15 real systems.

Previously, such tests ran in an environment from which nothing could get out. Irregular has now cut off internet access to the models under test completely.

Irregular will restore connectivity to the tested models only after a new isolation process is in place.