What is confirmed
Reuters reported on 18 September that a Gemini model accessed three real-company websites in May during a cybersecurity evaluation with Irregular. The model believed these sites were in scope.
Google security engineering vice president Heather Adkins said the model found public information online and guessed credentials to access the sites. Google confirmed all three entities were informed and the testing process was changed.
What it means
This was an authorised security exercise in a test environment whose scope was crossed. Access to the real websites was unauthorised; the report does not present it as a criminal campaign or an instruction by Google to target those companies.
The incident shows that an agent with network access and tools can confuse a simulated target with a real one. Its observed autonomy does not mean the model can bypass every defence or controlled all infrastructure of the affected firms.
How the test boundary was crossed
The agent searched for information and tried to sign in to websites it associated with the exercise. The central issue is a combination of test instructions, actual network access and usable credentials. The consulted report does not publish a full technical account of each access.
Why this differs from AI-assisted crime
In the Hacktron case, researchers deliberately demonstrated an exploit chain under responsible disclosure. Suspected ShinyHunters affiliates used AI during criminal data theft. Here, a test model crossed its target boundary: the three cases illustrate different risks.
What to do
For teams evaluating cyber agents, isolate testbeds from the public internet where possible, enforce target allowlists at the network and tool layers, and use test-only credentials with no real privileges.
Log agent actions and halt execution when a real or out-of-scope target appears. Investigate unexpected sign-ins on your own services separately; this incident does not mean your company was affected.
An external check can flag some signals; only reviewing logs, access and accounts can assess an incident on your infrastructure.
