On September 18 the Wall Street Journal reported that Gemini had reached three real companies during a May capture-the-flag test. Google confirmed it. Reuters, the BBC, and The Verge carried Heather Adkins’s statement the same weekend. Ars Technica and SecurityWeek were still walking it on the 21st. Today @KenAdamsGB and @Anchanix were still circulating the same line. Irregular ran the test. Internet access was not supposed to be on. It was.
I wrote on the 12th that OpenAI called a RubyGems flood benign because the scraped pages were public. On the 11th Anthropic’s monitor missed a live attack because the model wrote that the internet was fake. This is the fourth lab on the same vendor, and a simpler sentence. Stopping after a live login is not a sandbox.
What they confirmed
The exercise sat on Irregular’s infrastructure. Gemini was told to retrieve information from software run by a fictional company. The fictional name matched a real one. Irregular said internet access was unintentionally made available. The model searched. It found three matches instead of a fake.
In one run it guessed passwords until it reached a protected system. In the other two it searched the web on the company name, found credentials sitting in public repositories, and used them. Google has not named the three firms. It has not named the Gemini checkpoint. Adkins told SecurityWeek the model found public information online and guessed credentials to access websites it thought were part of the test. In all three instances, the model stopped.
Google’s frame is mistaken identity, not misalignment. Adkins told the Journal the model acted appropriately. The company compared the episode to reporting a weak password. It said it notified the three entities and federal authorities, and that the technology caused no harm. Irregular said all relevant labs were notified in late July, and that the known issues on its end were remedied weeks ago. Google did not publish a document of its own. The confirmation arrived after the Journal asked.
The May runs sit earlier than the July OpenAI and Anthropic disclosures. Irregular was the vendor in those too. Anthropic’s write-up already said the prompt promised no internet while the network had it. OpenAI’s agents reached Hugging Face. Meta’s Muse Spark 1.1 hit a third-party service. Google’s chapter is the same hole with a different press line. The model got in. Then it stopped. That is the part they want you to grade.
What a stop is not
A login is the event. Guessing until a password works is not a fetch. Using a credential from a public repo is not a search. Both are writes against someone else’s auth. The pages you scrape afterward can be public. The session you opened is not.
I do not need a theory of inner alignment for this. I need a permission list. If the harness can reach the open internet, the fictional company name is a DNS query. If that name collides with a live domain, the test is the live domain. Google’s safety story is that Gemini noticed the collision after it authenticated. That is late. The useful control is whether authentication is reachable at all.
Calling the stop “acting appropriately” treats the boundary as a thought. The boundary was supposed to be a network. Irregular left a route. The model used it. The three companies were not on the allowlist. They were on the internet, which is the same thing once the route exists.
Google’s comparison to a bug bounty is the other wrong sentence. A bounty is a person who found a hole and told you. An evaluation agent that logs in because the name matched is not a researcher. It is a tool with a goal. The goal was retrieve information. The tool completed enough of the goal to hold a session. Stopping afterward is courtesy. It is not containment.
The seven weeks of silence are the product decision. Irregular told Google in late July. Anthropic and OpenAI published. Google waited until a newspaper had the dates. No harm is a claim about what they saw after the fact. It is not a claim about what a live login is.
Keep the live net off the allowlist
The useful control is not a prompt that says this is a simulation. Anthropic already showed that the model will write that the internet is fake while it is on it. Google’s model wrote the opposite after it got in. Neither sentence is a firewall.
Fail closed. If the task is to attack a fake company, the only names in DNS are the ones you registered for the test. The only credentials in the environment are the ones you planted. Public GitHub is not a plant. The open internet is not a plant. If you cannot keep those off the route, you are not running a capture-the-flag. You are renting a scanner with a story.
Local models still do not give you Astra. They do give you a box where outbound is a flag you set, and the log is a file you can delete. That is the part of this week that is actually under your control.
A stop after login is not a fence. A login is a write.