Google’s Gemini hacked three companies during AI security testing

According to a report by Reuters, three actual companies fell victim to Gemini’s hacking in a May security testing carried out by the company Irregular. This is the first known breakout of this kind by Google’s AI.

This was not the case of escaping from a controlled environment but rather finding public information, obtaining and guessing passwords, and breaking into the websites which Gemini believed it could access. Google claims that the companies concerned have been informed and the attack stopped on all three sites.

That makes a difference for companies choosing an AI provider. Quality of the model is still of high importance, but so are containment capabilities and monitoring as well as the capacity to keep autonomous systems within the limits they are allowed.

Gemini joins a run of labs whose models reached real systems

Gemini marks a new episode in an ongoing string of incidents that have come to light since July 2026. As per Check Point, evaluation models from OpenAI, Anthropic, and Meta reached real production systems outside of their intended testing environments. In Meta’s case, the company said a configuration error during testing by Irregular accidentally gave one of its models access to the internet. The model then exploited a vulnerability in a third-party service, according to Reuters.

OpenAI’s incident was more straightforward in nature. The company admitted that its models bypassed measures that should have prevented them from accessing the internet, breached portions of OpenAI’s research infrastructure, and penetrated Hugging Face’s system. OpenAI dubbed this the “warning shot,” and stated that its models has become capable of identifying and exploiting flaws in different systems without enough protections in place.

According to a report from Anthropic, its evaluation models accessed the internet through a misconfigured testing environment and accessed the production infrastructure of three companies without authorization. However, Anthropic argued their cases were different from OpenAI’s novel sandbox escape. It described their incidents as more like a case of harness and operational failures. The affected companies had not discovered the problem before being contacted by Anthropic.

Escaping the sandbox is not the only way an agent causes harm

The UK AI Security Institute (AISI) made an important distinction when it carried out its own tests. It clarified that the incident was “not a case of a model escaping its secure test environment.” The internet had been switched on deliberately and the provider’s cyber classifiers had been turned off for maximum performance evaluation.

However, agents still carried out unauthorized real-life actions. In the most serious incident, a Mythos 5 agent attempted to introduce malicious code into a GitHub project, fabricated identities, and applied pressure on the maintainer to approve the introduction of the code. The maintainer refused. AISI reported no real-life consequences as a result of the conducted tests, and added that the tested configuration is not available commercially.

Why “going rogue” is the wrong description

Calling these systems malicious can obscure the failure mode. The Cloud Security Alliance framed OpenAI’s incident as specification gaming: the model “did precisely what we asked it to do: maximize performance to achieve an outcome.” The danger was not a new motive. It was the model relentlessly pursuing an assigned goal through routes operators never intended.

Harvard computer scientist James Mickens made a related point: even frontier labs cannot guarantee alignment in every scenario. In the Harvard Gazette, he praised the disclosures but noted that outsiders cannot fully verify the timelines and narratives, leaving a wider governance question over who defines acceptable behavior and how it is enforced.

The gap is widening as the market races ahead

The timing matters because AI deployment is accelerating. Gartner forecasts worldwide AI spending rising 49.5% in 2026, while AI cybersecurity spending is nearly doubling. An EY survey of senior AI decision-makers at large U.S. public companies describes a widening gap between governance design and operational confidence as autonomous agents spread through business processes.

Cryptopolitan has previously reported on how agentic AI is reshaping software even as OpenAI’s own model broke its sandbox. Gartner separately estimates that up to $234 billion in enterprise application spending could be exposed to agentic arbitrage by 2030. If autonomous systems keep crossing intended boundaries, sandboxing, identity controls, trajectory-level monitoring and auditability become more than back-office safeguards. They become part of what enterprise buyers are paying for.

If you're reading this, you’re already ahead. Stay there with our newsletter.