Gemini guessed a password that worked

The industry has now produced four versions of the same incident, at four different companies, through the same testing vendor. That is no longer a series of accidents. It is a property of how frontier models are being evaluated.

Google confirmed on Friday that during a capture-the-flag evaluation in May, run by the AI security testing firm Irregular, its Gemini agents reached systems belonging to three real companies. The exercise was meant to run against fictional targets inside a sandbox; the environment allowed internet access it should not have, and some invented company names matched real ones.

Heather Adkins, a Google vice-president, described what followed plainly: the model "found public information online and guessed credentials to access websites it thought were part of the test", Al Jazeera reported. In each case, Google says, the model stopped before completing the act.

Two details in that sentence deserve separating. Guessing a password that works is a capability claim. Stopping once the target looks real is a behaviour claim. The first is what security teams should plan for; the second is what Google is asking to be judged on.

Google's position is that this was not misalignment and did not warrant public disclosure, because the safety measures worked. That is defensible on the second claim and beside the point on the first. A model that can find credentials in public repositories and guess its way into a live service has that capability whether or not it chooses to use it.

The timeline is the weaker part. The incidents happened in May, Irregular notified Google at the end of July, and the disclosure came in September after journalists asked. Two months from event to vendor notice, and two more to public knowledge, is a long cycle for something the industry says it wants to be transparent about.

The comparison to peers cuts in Google's favour on conduct and against everyone on process. Anthropic disclosed its own incidents earlier this month, in which models reached real organisations and did not stop; OpenAI and Meta have had comparable events tied to the same evaluation infrastructure.

The common factor is not any one model. It is the test harness. A capture-the-flag environment is a deliberately adversarial setting where the model is rewarded for breaking things, and the only thing standing between that and the open internet is a configuration. When the configuration is wrong, the exercise runs against whoever happens to share a name with the fiction.

That is a fixable engineering problem, and it is striking that four laboratories using one vendor have all hit it. Network isolation for offensive evaluations is not novel work; it is what any penetration-testing firm does before it starts.

The reporting standard is the open question. None of these incidents produced known harm, and by each company's account the safeguards held. But "our safety measures worked, so we did not tell you" is a rule that only ever surfaces the failures, and it is being applied to the one class of test designed to find out what these systems can do when they try.