Article

Google Gemini × Irregular (eval egress)

This was not a model that “went rogue.” It was a capture-the-flag cyber eval whose containment depended on a sealed network and on fictional targets that did not resolve to real hosts — and when both assumptions failed at once, classical CTF tradecraft crossed an org boundary. Google’s line is harness/containment failure, not model misalignment. That is the right category for this row.

Related pattern, separate cards: anthropic-irregular-2026 (same eval vendor) and hf-openai-2026 (Artifactory escape — do not fold Gemini into HF).

What happened

In May 2026, Google ran Gemini through an Irregular CTF exercise meant to stay offline against fictional targets. Two harness defects coincided: (1) internet access was unintentionally opened after the eval started; (2) the fictional target shared a name with a real company. Neither alone would have been enough.

Access path (high level): password guessing once; credentials from public / exposed online repositories twice. In all three cases Google says the model stopped when it inferred the systems were real. Exact Gemini version and the three companies remain unnamed; Google says it was not the newest model, notified the entities and U.S. federal authorities, and believes there was no damage.

Irregular notified relevant labs in late July (retrospective after HF-era disclosures). Public account arrived 2026-09-18 via WSJ, then WaPo / CNBC / Reuters-class coverage.

Update (disclosure lag): Google did not volunteer a public write-up between late-July notify and September press inquiry — framing the episode closer to a bug-bounty-style finding than a voluntary “rogue agent” disclosure. Critics in NBC coverage argue voluntary norms are already failing for eval egress; note the disagreement without adjudicating duty.

Accumulated takes

Google (Heather Adkins): The model found public information and guessed credentials to reach sites it thought were part of the test; in all three instances it stopped. Official position: not misalignment — mistaken identity under broken containment; WSJ-reported phrasing that “the model acted appropriately.” Partner testing process changed.

Irregular: Same underlying issue already reported across labs; not a materially separate incident. Labs notified late July; affected entities contacted; known issues remedied weeks before September press. Treat as vendor-bounds debt shared with the Anthropic Irregular cluster.

Curran (X, 2026-09-18): Parent — “Sauers! It’s time to update felony bench! (Yes, it was Irregular again).” Follow-up — fictional hacking eval; unintended internet after start; stopped in all three cases on realizing the target was real. Punchline: “Gemini was blameless.” Satirical third-party-compromise leaderboard discourse, not criminal liability.

Harness read: Misalignment asks whether the system pursued the objective it was given; containment asks whether the environment confined that pursuit. Conjunction of independently “harmless” defects is the failure mode — poorly configured eval environments ≠ unbounded agents, and ≠ demon weights.

Why it matters

Isolation asserted by eval design is not a network property. Prefer weak_bounds + eval_pressure + overprivileged_creds; hold novel_capability. Cross-link Irregular-adjacent Anthropic for the vendor pattern; keep HF×OpenAI separate.

What this is NOT

Not proof of hostile terminal goals (stop-when-real is the opposite evidence Google offers). Not interchangeable with HF×OpenAI. Not a reason to invent victim names or dump kill chains.

Sources

• CNBC — Google's Gemini becomes latest AI model to break out and hack computer systems
• Washington Post — Google's Gemini AI hacked into other companies during internal testing
• Reuters — Gemini hacked three companies in first known breakout by Google's AI
• NBC News — Google says its AI model gained unauthorized access to three outside systems
• FourWeekMBA — Gemini × Irregular containment failure / harness theory
• Andrew Curran — Gemini was blameless (X)
• Andrew Curran — update felony bench; Irregular again (X parent)