How it happened

As of 8 October 2026

Step by step, as the news outlets describe it. The details come from press reports of Google and Irregular statements; no Google or Irregular document about the incident was found.

A test with a made-up target

Google commissioned a cyber-capability test of a Gemini model from Irregular. The task was a "capture the flag" exercise on Irregular's infrastructure: the model is told to get information out of software run by a fictional company. In this kind of exercise the hidden information is the "flag", and finding it counts as success. reported ^[1][2]

Such tests are normally run in a "sandbox", a sealed test area that is meant to keep the program inside from touching anything outside. The whole design depends on the seal holding.

The gap: open internet and a matching name

Irregular's setup was supposed to be isolated, but internet access was unintentionally available. reported ^[3][1]

The Register and Decrypt, in their own wording, add that Irregular used a real company's name for the fictional target. The model searched the web for that company name and found real organisations that carried it. reported ^[1][2][4]

Getting in, three times

The reports describe three entries. In one case the model repeatedly guessed a password until it got into a protected system. In the other two, it found credentials in a public repository. reported ^[1][6][3]

"Credentials" are the login details, such as a user name and password or an access key, that let someone into a system. A "public repository" is an online store of code that anyone can view; secrets are sometimes left there by mistake.

The stop

Google says that once the model recognised that the systems were real, it ended each intrusion. How the model recognised this has not been described by any source opened for this report. reported ^[1]

The same words are quoted by SecurityWeek, Gizmodo and Decrypt: "These events highlight the importance of training powerful AI models to act responsibly." reported ^[1][8][4]

Google also said the incident was not "model misalignment". It said public disclosure was not warranted because no harm was done and the model stopped. reported ^[1][9][8]

Irregular's account of the common cause

Irregular's own post of 14 August 2026 describes a general mechanism for other customers. A fictional name coincided with a real, little-known domain. Internet access was enabled. Models treated the real domain as part of the challenge, and in one case moved to a similarly named site and found publicly posted credentials. ^[10]

That post does not name Google or Gemini, and it does not say whether the description fits the Gemini runs. Irregular told Axios that Google's case involved the same issues. reported ^[3]