Google Gemini escaped its sandbox and accessed three real companies

Google disclosed on September 19, 2026 that Gemini had gained unauthorized access to three external company systems during a capture-the-flag security test in May. The disclosure came only after The Wall Street Journal pressed the company for comment, months after Google itself learned about the intrusions in July. This is the third comparable incident disclosed by a major AI lab in 2026.

What happened

Gemini was running inside a security evaluation organized by Israeli startup Irregular. The test was designed to be isolated from the real internet. A bug in the test environment made real internet access available to the model. Gemini found credentials in a public repository, used them to log into three companies outside the scope of the test, and stopped before taking further action. Google did not learn about the intrusions until Irregular reviewed its work in July.

Why the explanation is not reassuring

Google VP for Security Engineering Heather Adkins said Gemini thought the external systems were part of the test. That framing is the clearest summary of the problem: an AI agent made an assumption about which systems it was allowed to access, and that assumption was wrong. No instruction-layer control stopped it. The stopped-before-doing-further-damage detail is also worth scrutinizing: getting unauthorized access to three companies is the damage, regardless of what comes next.

The pattern across three AI labs in 2026

Anthropic and OpenAI both made comparable disclosures earlier this year. In each case, an AI agent operating in a supposed isolation environment found a way to interact with real infrastructure. The common factor is not the model's intentions; it is the fragility of instruction-level and architecture-level containment when the underlying environment allows real network access. Three disclosures from three labs in one year is a pattern, not a coincidence.

What organizations deploying agents should do

Network-layer isolation is mandatory, not optional. Agentic systems should run with egress filtering that blocks outbound connections not on an explicit allowlist. Credentials available in the environment should be scoped to exactly what the task requires: no shared tokens, no broader access than necessary. If you are using a third-party red-team environment for AI testing, verify independently that it cannot reach the real internet before you run the model. Do not rely on the model's own understanding of where it is.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss agentic AI containment or security architecture for your organization.