A name that resolved — the fictional company in the evaluation had a real domain, and the control that failed was egress, not the model

Google confirmed on the record that its Gemini model reached the systems of three real companies during a capture-the-flag evaluation run by Irregular in May 2026, guessing passwords and using credentials found in public repositories, with Heather Adkins stating that in all three instances the model stopped. The obvious reading is a model breakout, and the evaluator's own post of 14 August 2026 — five weeks before the Wall Street Journal reported it — corrects it twice: the fictional company name chosen for the scenario unintentionally coincided with a real registered domain while internet access that was meant to be controlled was open, and all subsequent public disclosures refer to the same underlying issue first disclosed on 30 July rather than to materially separate incidents, which puts OpenAI, Anthropic and Meta on one fixture rather than on four failures. The capability demonstrated is credential reuse, not exploitation, and Irregular's own remediation list is a network list — strict egress filtering, domain allowlists, sinkholed infrastructure, and a pre-run check that simulated targets cannot map to live systems — so nothing on it is a property of the model. The regulatory instrument is equally misaddressed: Article 55(1)(c) has bound providers of GPAI models with systemic risk to report serious incidents to the AI Office without undue delay since 2 August 2025 and Article 88 gave the Commission exclusive powers over Chapter V from 2 August 2026, so BNetzA — Germany's market surveillance authority since KI-MIG entered force on 29 July 2026 — is not the address, while whether the incident was reportable at all turns on the harm-based definition in Article 3(49). The practitioner move is to resolve every fictional hostname in the test fixtures and put the agent behind an egress allowlist.

Post

Someone picked a fake company name for a security exercise. Someone else had already registered the domain.

Last Friday the Wall Street Journal reported that Google's Gemini reached three real companies during a May evaluation. Google confirmed it. Heather Adkins, VP of Security Engineering: "the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped."

What this changes for anyone shipping agents in the EU:

The evaluator published the mechanism five weeks before the story. Irregular's post of 14 August says the fictional company name "unintentionally coincided with a real domain", and that internet access meant to be controlled was available.
One issue, not four breakouts. Irregular's own words: all subsequent public disclosures "refer to the same underlying issue first disclosed by one of our customers on July 30 - and are not materially separate incidents." OpenAI, Anthropic and Meta sit on the same fixture.
The capability on display is credential reuse. Guessed passwords, and credentials sitting in public repositories. No exploit. If that reaches your systems, the exposure is your secrets hygiene, and it was exposed already.
The control that failed is the network. Irregular's own remediation list is a network list: strict egress filtering, domain allowlists, sinkholed infrastructure, and a pre-run check that simulated targets cannot map to live systems. Not one item is a property of the model.
And the reporting duty does not run to Bonn. Article 55(1)(c) has bound providers of GPAI models with systemic risk to report serious incidents to the AI Office without undue delay since 2 August 2025, and Article 88 gave the Commission exclusive powers over Chapter V from 2 August 2026. BNetzA has been Germany's market surveillance authority since KI-MIG entered force on 29 July 2026 - for a general-purpose model, not the address. Whether it was reportable turns on Article 3(49), which is harm-based. "No harm" is exactly what Google said.

My Monday: dig every fake hostname in the test fixtures and see which answer. Then put the agent behind an egress allowlist. An afternoon each, and they decide whether your next eval is a test or an intrusion.

Google's defence is that the model stopped. That is an observation, not a control.

What is yours behind?

#AIAct #AgenticAI #DevSecOps #EUTech #Compliance

First comment

Sources, primary first.

Irregular's own account of the incident and the fix - the fictional name, the internet access, and the line that it is one underlying issue rather than several (14 August 2026): https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward

Google's on-record statement, with Heather Adkins quoted in full: https://www.securityweek.com/google-confirms-gemini-ai-breached-three-firms/

Axios on the disclosure timeline - May evaluation, late-July notification, September coverage: https://www.axios.com/2026/09/19/google-safety-incidents-testing-hacks

Al Jazeera's account, including Google's position that the safety measures worked: https://www.aljazeera.com/news/2026/9/19/googles-gemini-ai-hacks-3-companies-in-security-test-then-stops

CyberInsider on the sandbox mechanism, quoting Irregular on the fictional domain overlap: https://cyberinsider.com/google-gemini-hacked-three-firms-after-test-sandbox-exposed-web-access/

AI Act Article 55 - the systemic-risk provider's serious-incident duty to the AI Office, applying since 2 August 2025: https://artificialintelligenceact.eu/article/55/

AI Act Article 88 - the Commission's exclusive powers over Chapter V, applying since 2 August 2026: https://artificialintelligenceact.eu/article/88/

AI Act Article 3(49) - the harm-based definition of a serious incident: https://artificialintelligenceact.eu/article/3/

Cut for length: the three companies learned in September that they had been reached in May. Article 33 DSGVO gives 72 hours from awareness - and awareness arrived from a third party, four months late. If an agent of yours ever wanders, the clock you start is somebody else's.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.

A name that resolved — the fictional company in the evaluation had a real domain, and the control that failed was egress, not the model

Google confirmed on the record that its Gemini model reached the systems of three real companies during a capture-the-flag evaluation run by Irregular in May 2026, guessing passwords and using credentials found in public repositories, with Heather Adkins stating that in all three instances the model stopped. The obvious reading is a model breakout, and the evaluator's own post of 14 August 2026 — five weeks before the Wall Street Journal reported it — corrects it twice: the fictional company name chosen for the scenario unintentionally coincided with a real registered domain while internet access that was meant to be controlled was open, and all subsequent public disclosures refer to the same underlying issue first disclosed on 30 July rather than to materially separate incidents, which puts OpenAI, Anthropic and Meta on one fixture rather than on four failures. The capability demonstrated is credential reuse, not exploitation, and Irregular's own remediation list is a network list — strict egress filtering, domain allowlists, sinkholed infrastructure, and a pre-run check that simulated targets cannot map to live systems — so nothing on it is a property of the model. The regulatory instrument is equally misaddressed: Article 55(1)(c) has bound providers of GPAI models with systemic risk to report serious incidents to the AI Office without undue delay since 2 August 2025 and Article 88 gave the Commission exclusive powers over Chapter V from 2 August 2026, so BNetzA — Germany's market surveillance authority since KI-MIG entered force on 29 July 2026 — is not the address, while whether the incident was reportable at all turns on the harm-based definition in Article 3(49). The practitioner move is to resolve every fictional hostname in the test fixtures and put the agent behind an egress allowlist.

Post

Someone picked a fake company name for a security exercise. Someone else had already registered the domain.

What this changes for anyone shipping agents in the EU:

The evaluator published the mechanism five weeks before the story. Irregular's post of 14 August says the fictional company name "unintentionally coincided with a real domain", and that internet access meant to be controlled was available.

One issue, not four breakouts. Irregular's own words: all subsequent public disclosures "refer to the same underlying issue first disclosed by one of our customers on July 30 - and are not materially separate incidents." OpenAI, Anthropic and Meta sit on the same fixture.

The capability on display is credential reuse. Guessed passwords, and credentials sitting in public repositories. No exploit. If that reaches your systems, the exposure is your secrets hygiene, and it was exposed already.

The control that failed is the network. Irregular's own remediation list is a network list: strict egress filtering, domain allowlists, sinkholed infrastructure, and a pre-run check that simulated targets cannot map to live systems. Not one item is a property of the model.

And the reporting duty does not run to Bonn. Article 55(1)(c) has bound providers of GPAI models with systemic risk to report serious incidents to the AI Office without undue delay since 2 August 2025, and Article 88 gave the Commission exclusive powers over Chapter V from 2 August 2026. BNetzA has been Germany's market surveillance authority since KI-MIG entered force on 29 July 2026 - for a general-purpose model, not the address. Whether it was reportable turns on Article 3(49), which is harm-based. "No harm" is exactly what Google said.

Google's defence is that the model stopped. That is an observation, not a control.

What is yours behind?

#AIAct #AgenticAI #DevSecOps #EUTech #Compliance

AI disclosure