What to do

As of 8 October 2026

What Google and Irregular said they have done or advise, followed by clearly labelled general advice. No source gives advice for the three affected companies.

What Google and Irregular said

Google said it made sure the three companies were made aware and worked with its training partner on changes to that partner's testing processes. Its statement also says powerful AI models should be trained to act responsibly. reported ^[1][2][3]

Irregular's 14 August 2026 post says fictional names should be rechecked continuously against new real domains, and that forensic evidence, such as transcripts, should be shared across organisations. ^[4]

Irregular's advice to evaluators

On 5 October 2026 Irregular published guidance after a different, unnamed containment incident. It is not about Gemini, but it is the most specific advice any source offers to teams that test AI systems. ^[5]

• Run a dedicated "containment challenge" before any capability evaluation, to check that the test area really holds.
• Test the whole configuration: the model, the harness around it, its tools, permissions, limits and the infrastructure.
• Give the containment test as much time and budget as the evaluation itself.
• Retest whenever something changes.

What critics say

Jack Cable of Corridor told the Wall Street Journal that Google seemed to be hiding behind vulnerability-disclosure norms. reported ^[6] Dark Reading's editors also said Google should have disclosed earlier; that is opinion. reported ^[7] Neither gives explicit instructions.

General good practice (not from the sources)

This short list is general advice, not advice from Google, Irregular or any outlet.

• Teams running AI agents: assume a test area is open until you have shown it is closed, and check that it blocks outside network access.
• Teams running AI agents: use made-up names for test targets that do not match real organisations or domains.
• Anyone: never leave passwords or keys in a public code repository, and rotate any that have been exposed.
• Anyone: rate-limit or lock out repeated failed logins, so password guessing does not succeed.