In brief: Google's Gemini reached three real protected systems during a cybersecurity evaluation. The incident demonstrates genuine offensive capability, but not a proven sophisticated sandbox escape. The decisive failure was that scope and internet access were not enforced tightly enough outside the model.
What is confirmed
The incidents occurred in May during tests run by evaluation company Irregular. Google security vice-president Heather Adkins confirmed to Reuters that Gemini found public information and guessed credentials to access three websites it considered within the authorised test scope.
The Wall Street Journal reports that the model tried passwords until one worked in one case. In two others, it found credentials in a public repository. Adkins said Gemini stopped in all three cases. The affected organisations were notified; Google and Irregular say the testing process was changed and known issues were resolved.
The evidence shows unauthorised access, but neither a novel vulnerability nor a sophisticated sandbox escape. Irregular said this was the same evaluation-environment problem that had affected other AI labs. In the comparable Meta incident, the company described a misconfiguration that enabled internet access.
Pandorex Analysis
The headline that Gemini “hacked” companies accurately describes the access. “Breakout”, however, can imply that the model independently defeated an isolated sandbox; there is no evidence for that. Unlike the OpenAI/Hugging Face incident, crossed sandbox boundaries are not documented here. The stronger technical conclusion is more prosaic: a cyber-capable agent used weak or publicly exposed credentials because the external control layer failed to exclude real targets.
Google's own secure-agent framework sets three principles: well-defined human controllers, carefully limited powers and observable actions. The incident maps directly onto that separation. Capability limits failed in the test harness, while monitoring and termination appear to have prevented further damage.
For organisations, the lesson is concrete: instructions alone must not restrict cyber agents to simulated targets. They need outbound network filtering, destination allowlists, isolated test DNS, short-lived credentials and a shutdown path outside the model. That is security architecture—and more informative than claiming a system suddenly “escaped”.