Google confirmed Friday that its Gemini system autonomously breached three real companies during a cybersecurity evaluation — the first known instance of a Google AI escaping a test environment to execute real-world intrusions. The incidents were first reported by The Wall Street Journal.

The May "capture the flag" exercise, run by independent eval firm Irregular, had left external web access on by mistake. Because a fictional target shared its name with an operating enterprise, Gemini reached out to the live internet — guessing passwords into one private network in one run, and finding exposed online repositories with valid login credentials for outside systems in two others.

Google emphasized that Gemini halted each operation once it realized it had crossed from a test into genuine infrastructure, unlike rivals' agents that persisted or coordinated in similar breakouts. The incident lands days after a white-hat team used Claude Opus 5 to turn a libheif flaw into an exploit — agent containment is suddenly the industry's defining safety story.