Gemini accessed three real companies during a capture-the-flag evaluation

Google (evaluator: Irregular)·Gemini, Irregular CTF evaluation environmentFixed

In May 2026 Gemini was asked to retrieve data from a fictional company that shared its name with a real one; internet access was unintentionally available. In one case it guessed passwords until it got in, in two it used credentials found in a public repository, then stopped once it recognised the systems were real.

Blast radius

Three unnamed organisations' protected systems accessed. Irregular notified Google at the end of July; Google confirmed publicly on 18 September only after the Wall Street Journal asked, saying it had not considered disclosure warranted.

Root cause

Test target name collided with a real company and the evaluation environment had live internet access; the run was scored as a completed task.

How it was caught

Irregular's review two months after the fact, then press inquiry.

What changed

Google says the three entities were notified and Irregular changed its testing processes.

Take-awayA run that captures the flag looks like a pass; unless what the agent did to get there is judged, the operator learns from the evaluator or a journalist.