A fictional target name that matched a real company steered Gemini into three live networks

Either of two controls would have contained this run on its own. Irregular's environment had public internet access, enabled because realistic cyber exercises sometimes require it, according to Irregular ^[18]. Block egress and a name collision produces a connection that goes nowhere. Keep egress open but give the fake target a name nobody owns, and the agent scans for a host that does not exist. Both controls failed in the same evaluation, so the models had a reachable target and a reason to prefer it ^[17][4].

Irregular said most runs stayed inside the intended environment, and that a small number went after the matching real domain or a site with a similar name ^[10]. The three companies come out as one password-guessing run plus two credential reuses ^[14]. Both techniques are old. Password guessing and using credentials exposed in public repositories are basic intrusion methods even when an agent performs them without step-by-step human direction, and the public evidence does not show a novel exploit or a deliberate escape from a secured sandbox, according to runtimewire's account ^[9].

For the capability half of this to transfer to a model you can call today, you would need the versions. They have not been released, and neither have the companies' identities or the precise information the models reached inside ^[12].

The run was in May ^[2]. The Wall Street Journal first reported the incidents and Ars Technica detailed them ^[6]. Irregular did not tell Google until July, about two months later, Ars reported ^[8][13]. Google notified the affected companies after that, and confirmed the incidents on September 18 ^[8][2].

Google's security leadership has focused on what the models did once they were in. "In this case, the model acted appropriately," Heather Adkins, Google's vice president of security engineering, said in Ars Technica's report ^[7]. Google said the models stopped after recognizing they had reached real infrastructure ^[1]. That reduced the potential damage without authorizing the access that came first. On runtimewire's reading, the system owner, the lab and the evaluator each end up with an incident to handle ^[15].

Irregular's usual process already included checking fictional names for overlaps with real companies or websites, and that check failed in this evaluation, per its August 14 incident review ^[5]. In my view a harness built to measure offensive capability should put its strongest control at the network edge: a default-deny egress rule still holds when a review step gets skipped, and a name check only works when someone runs it. Lahav and Nevo founded Irregular on the argument that frontier models are gaining offensive capabilities faster than the industry is establishing dependable ways to measure them ^[16]. The May run produced evidence for that argument.