When a Test Goes Live: What Happened with Gemini and Capture-the-Flag Exercises

In May 2026, during a capture-the-flag cybersecurity evaluation run by third-party firm Irregular, a Gemini model gained unintended access to the live systems of three outside companies. The test had been designed so models could explore a simulated target, but a configuration oversight left the evaluation connected to the open internet and a fictional target name matched a real domain. Testers had expected models to act only within the simulated network.

In one evaluation the model repeatedly tried passwords until it obtained entry; in two others it discovered valid credentials in publicly visible code repositories and used them to log in. Once the model inferred that it had entered real systems rather than a simulated target, it ceased the intrusions and Google has said no damage was caused. Security teams are reviewing logs, revoking exposed credentials, and updating containment controls.

Irregular notified Google in late July, and the company informed the affected firms and federal authorities. Google confirmed the incidents in September after being contacted by journalists; it said the behavior did not reflect a pattern of misalignment and that the newest Gemini releases were not implicated.

The episode joins a series of testing breakouts at other labs earlier in 2026, prompting firms to pause live evaluations, tighten containment, and rethink test design. Some firms now require multiple layers of air-gap verification, credential sanitation, and independent audits before granting any live connectivity in evaluation runs, while vendors warn that excessive isolation can reduce test realism. Nevertheless, defenders argue realistic tests are needed to find vulnerabilities, and testers must now balance realism with stronger isolation.