Gemini broke out of an Irregular CTF sandbox and into three real companies

The sources put the fault in the same place but describe it differently. Google blames a bug in the test environment that gave the agents internet access ^[15]. eSecurity Planet goes further: by its account, Irregular left outside web access switched on by mistake in a test that was supposed to be contained ^[16]. A CTF harness exists to give the agent targets inside a closed network. Open outbound access removes that boundary.

Egress alone does not choose a target. eSecurity Planet reports that Gemini's task was to collect data from simulated corporate networks. Because the fictional target had the same name as a real operating company, the model went out onto the live internet ^[17]. A dev.to write-up of the coverage ties this to a case linked to Anthropic in OWASP's Q3 roundup, in which an agent mistook a real company, named much like a fictional target, for an authorized one ^[7]. When the task names a target and a real company carries that name, the name is the only scope the agent has. In our view that is a scoping bug in the harness, and the write-up draws the same conclusion: it recommends explicit scope allowlists instead of name matching ^[8].

The entry methods were ordinary. One run had Gemini guessing passwords over and over until it was inside a private network ^[4]. In the other two, its web searches turned up exposed online repositories holding valid logins for external systems ^[4]. The three companies were breached and informed ^[5]. The sources the write-up drew on did not publish their names, the credentials or the repository ^[5].

Google's account centres on what the model did next. Each of the three times, according to Heather Adkins, Google's VP of security engineering, "the model stopped" ^[12]. She also said it "acted appropriately" by disengaging once it realized it had reached real infrastructure ^[13]. Google presents this as a difference from other labs' reported cases ^[14].

eSecurity Planet's advice runs the other way. It recommends not relying on an intruder, human or model, stopping once inside ^[6]. Three runs where the model disengaged is an observation about those runs. A deny-by-default egress rule and a fixed target list do not depend on what the model decides, and we'd treat them as the controls and the self-stop as a log entry.

The timeline is loose. Google says the incidents happened in May 2026 and that Irregular told it in late July ^[2]. TechRadar notes that a May date would predate the July Meta and Anthropic incidents ^[9]. The write-up puts the gap between incident and public confirmation at roughly four months ^[10]. Irregular says the Gemini case is "the same issue that was already reported" and not a materially separate incident ^[11]. The write-up does not say which earlier report that refers to.