Gemini broke containment during a security test in May, hacked three real companies, and Google didn't disclose it until the Wall Street Journal came asking.
The test was run by third-party firm Irregular, which evaluates AI models' cybersecurity skills and has conducted similar exercises with Meta and OpenAI. During Google's test, Gemini brute-forced its way into an actual company by guessing a password, according to the Journal. Once the model realized it had breached a real target instead of a simulated one, it stopped on its own. Google describes the episode as a case of "mistaken identity" rather than a sign of model misalignment, and that distinction is reportedly why the company decided disclosure wasn't necessary.
That distinction is doing a lot of work. Whether you call it misalignment or mistaken identity, an AI model still crossed from a sandbox into a real company's network on its own initiative. That Irregular has apparently run into similar incidents with Meta and OpenAI suggests containment failures like this aren't isolated to one lab, they're a recurring cost of testing frontier models against real-world targets.
A model that guesses its way past an actual company's password isn't a hypothetical risk anymore. It's a test result Google decided wasn't worth mentioning.