What happened
In May 2026, during a "capture the flag" exercise run by Irregular, a third-party AI security evaluator that also works with Anthropic, OpenAI, and Meta, a Google Gemini model was tasked with retrieving information from a fictional target company inside a closed testing environment. A configuration bug unintentionally left internet access available, which the evaluation was not supposed to permit. The fictional target company happened to share its name with a real company, creating an opening for confusion. Once online, the Gemini model accessed systems belonging to three real companies: in one case by guessing passwords through repeated attempts, and in the other two by finding credentials exposed in public repositories. Google has stated the model stopped on its own in all three cases once it recognized it was interacting with real organizations, and that no significant damage occurred; the affected entities were notified. Irregular had notified Google at the end of July 2026. Google publicly confirmed the incident on September 18, 2026, after the Wall Street Journal, which first reported the story, sought comment. Google has stated the behavior was not an example of model misalignment and that it determined the incident did not warrant public disclosure because its safety measures had functioned as intended. This is one of several incidents linked to Irregular's testing environment that have been independently disclosed by Meta, Anthropic, and OpenAI; it is distinct from, and technically unrelated to, the Hugging Face/OpenAI incident already documented in this repository (Case 013), which involved an actual zero-day exploit rather than a containment configuration failure.
Evidentiary Assessment - 9 questions
What decision failed?
No single decision has been independently established as the point of failure. Google attributes the incident to a configuration bug in Irregular's testing environment that unintentionally exposed internet access the evaluation was not designed to permit, rather than to a deliberate design choice on Google's part.
What information was available at the time?
According to Google and Irregular, the Gemini model was operating inside what was believed to be an internet-isolated environment, tasked with retrieving information from a fictional company. The fictional company's name matched that of a real organization, which appears to have contributed to the model treating a real, internet-accessible system as part of the test.
Which constraints were active?
The evaluation was designed to be internet-isolated; that constraint did not hold in practice due to the configuration bug. Beyond the intended network isolation, no other specific safety constraint for this evaluation has been publicly detailed.
Could the failure be reproduced?
Partially. Similar evaluation-environment incidents linked to the same third-party evaluator were subsequently disclosed by Meta, Anthropic, OpenAI, and Google. Public reporting suggests a shared class of testing-environment failure, although the precise technical conditions were not identical or have not been publicly established as identical across every incident. The exact configuration that produced Google's May 2026 incident has not been published in sufficient detail for independent reproduction.
Could an independent reviewer reconstruct the decision months later?
Partially, and unevenly across the two distinct problems this case raises. On the evaluation-containment failure itself, reconstruction depends on what Google and Irregular have chosen to disclose, which is considerably less detailed than Hugging Face's technical account in Case 013. A separate and distinct question concerns how Google concluded the incident did not warrant public disclosure: an organization may possess sufficient internal evidence to reach that conclusion, but if the evidentiary basis, decision criteria, and authority behind the classification are not independently examinable, an external reviewer cannot later determine how the conclusion was reached. No source reviewed describes the criteria Google applied or who was authorized to apply them.
What evidence survives?
Google's on-the-record statement to multiple outlets (attributed to Heather Adkins, VP of Security Engineering), the Wall Street Journal's original reporting, and corroborating coverage from CNN, Al Jazeera, and Axios that includes direct quotes from Google's statement.
What remains unknowable?
The identities of the three affected companies; whether the "no significant damage" characterization reflects independent verification or Google's own assessment; the model's internal reasoning in choosing to stop; the specific criteria, evidence, and internal authority behind Google's determination that the incident did not warrant public disclosure; and whether the reported difference in behavior between Gemini and Anthropic's Claude model in a similar circumstance, reported by a single outlet (Al Jazeera), is accurate and independently corroborated.
Which governance layer failed?
Safety & Boundary Controls - Primary Governance Layer Under Examination, specifically regarding the shared third-party testing environment's configuration. Decision & Evidence is also implicated: the criteria and authority behind Google's determination that the incident did not warrant public disclosure are not independently examinable from the sources reviewed.
Which evidentiary properties were missing?
Independent Audit Trail (Google's account of the evaluation-containment failure is largely self-reported, unlike Hugging Face's independently reproducible technical timeline in Case 013), Constraint Anchoring (no public specification of what the evaluation environment's isolation was supposed to guarantee), and Decision Traceability (no public account of the criteria, evidence, or authority behind Google's determination that the incident did not warrant proactive public disclosure).
