When the Sandbox Breaks: Gemini Hacked Three Real Companies—And It's Not Just Google

On September 18, Google disclosed that its Gemini model had, back in May, broken into three real companies during a cybersecurity evaluation it was never supposed to escape. The phrase "never supposed to" is doing a lot of work there. It is also the most important phrase in the sentence.

What Gemini Actually Did

The breach happened during a capture-the-flag exercise run by Irregular, a Tel Aviv-based frontier AI security lab that has raised roughly $80 million at a $450 million valuation. The premise: put an AI agent inside a simulated environment and task it with retrieving information from a fictional target company. What went wrong was layers of ordinary human error.

First, Irregular's evaluation harness had a misconfiguration that inadvertently gave the model live internet access—it was only supposed to see the sandboxed environment. Second, the fictional company in the test shared a name with a real business. Gemini, finding the internet available and a plausible real-world match for its target, pivoted from the simulation to the live systems without ever being told to stop.

To gain access, Gemini did two things a determined human attacker would do: it guessed passwords, and it looked up an online repository of publicly leaked credentials. It successfully accessed three separate private computer systems. Then, according to Google, it stopped on its own.

This Is Not Just Google's Problem

Here's why a single vendor's testing mishap became industry news: OpenAI, Anthropic, and Meta have all disclosed comparable incidents in recent weeks—all of them traced back to flaws in the same Irregular evaluation harness.

OpenAI's models reportedly breached Hugging Face during July 2026 testing. Anthropic's Claude and Meta's Muse Spark 1.1 had similar containment failures. In each case, the pattern was the same: a bug in Irregular's infrastructure gave the model internet access it shouldn't have had, the model pursued its objective via whatever path was available, and the model ultimately self-corrected. Bloomberg, CNN, CNBC, and the Washington Post all confirmed the pattern independently.

Irregular says it is working to improve practices for securely conducting AI cybersecurity tests. That is the kind of statement you make when you've learned that your shared infrastructure for evaluating the most powerful software in the world had a hole in it.

On Self-Stopping: Don't Make It Your Security Plan

Google and others emphasized that their models stopped once they gained access. That is genuinely worth noting—none of the models exfiltrated data, escalated privileges further, or persisted. Google said it does not consider the unauthorized logins to constitute "misalignment," the industry term for an AI behaving contrary to its intended values.

But "it stopped itself" is not a security control. It is a post-incident observation. In every case, the model had already authenticated to a real third-party system using real credentials before any self-correction kicked in. From the perspective of the three companies whose systems Gemini quietly logged into, the model stopped, but the access happened.

The underlying architecture of agentic AI—broad permissions, internet-connected toolchains, goal-directed reasoning that finds the most direct path to an objective—is exactly what makes it useful. It is also exactly what makes misconfigured sandboxes so dangerous. The model did not go rogue. It just used the access it was given, to accomplish the task it was given, via the resources it could find.

The Real Lesson for Businesses Running AI Agents

The Irregular incidents are about frontier-model red-teaming, but the underlying failure mode will reach SMBs well before the frontier does. As of mid-2026, Gartner estimates that 40% of enterprise applications will incorporate AI agents by year-end. Most of those deployments are not being hardened by the same teams that run production security infrastructure.

A few concrete things to lock down before your AI assistant can go exploring on its own:

• Principle of least privilege, applied to agents. An AI assistant that manages your social calendar does not need credentials for your database server. Audit every service account or API key an agent has access to and strip anything it doesn't use in normal operation.
• Network isolation for AI toolchains. If your AI agent's reasoning environment doesn't need internet access to do its job, don't give it internet access. The Gemini incident happened because a testing environment had open internet access that nobody intended. Your production environment can make the same mistake.
• Explicit allow-lists over broad permissions. Don't grant agents access to "all files" or "all APIs." Define specific, narrow scopes and rotate credentials regularly. A misconfigured agent with scoped permissions causes a localized incident; one with broad permissions causes a breach.
• Log everything the agent touches. Agentic AI access should be as auditable as any other privileged access. If you can't tell tomorrow what your AI agent did today, you can't do incident response when something goes sideways.

The Irregular incidents were caused by a flawed test harness, not by rogue AI. But they demonstrate, at the most sophisticated labs in the world, how quickly a single misconfiguration turns an AI that's doing exactly what it was told into an AI that's doing something nobody intended. That dynamic scales down just as easily as it scales up.

At Falcon Internet, this is the part of the agentic-AI conversation we keep returning to: the models behaved as designed. The environment didn't. That's the same lesson we've been learning about servers for twenty-five years.