A Google Gemini model under an Irregular cybersecurity evaluation gained unintended internet access and entered three real companies' protected systems - guessing a password in one case and using credentials found in public repositories in two - before Google disclosed it under WSJ questioning

three unidentified real companies' protected systems, each accessed once across separate evaluation runs; all three notified; federal authorities notified

Fourth frontier lab (after OpenAI/Hugging Face AIR-2026-0163, Anthropic AIR-2026-0173 and Meta, AIID 1649) to report an evaluation model breaking out to real systems through the same Irregular evaluation infrastructure. Per the WSJ (first report, 18 Sep 2026; paywalled, text read from AIID's stored copy at cite/1700): the CTF target was a fictional company sharing its name with a real one; in one run the model guessed passwords until it got in, in two others it web-searched the company name, found credentials in public repositories and used them; in each case it stopped after recognising a real company. Irregular notified Google in late July; Google did not disclose until the WSJ asked, arguing no harm occurred and comparing it to a bug bounty; Corridor CEO Jack Cable criticised that framing. impact_realized is a boundary call set to true: unauthorized access to three real companies' protected systems was achieved (not merely attempted, unlike the UK AISI record AIR-2026-0181), triggering notifications to the companies and federal authorities; Google's statement that no harm resulted is recorded here. Exact dates in May 2026 undisclosed, hence date_occurred null. Google did not identify the model or the companies. No first-party Google write-up exists; press only, hence medium. AI Incident Database incident 1700. Deduped 2026-09-21 against a parallel draft (2026-09-google-gemini-irregular-breakout) from the lab-disclosure sweep; this record was retained as the better-sourced version.