Skip to content
Google Gemini hacked three companies: what Google's statement actually says, Anthropic's three in 141,006 runs, and the five agent clauses a Pakistani software house writes before its EU client does
Back to Blog
#Google Gemini#AI agent security#Irregular#Anthropic#sandbox egress#Cyber Resilience Act

Google Gemini hacked three companies: what Google's statement actually says, Anthropic's three in 141,006 runs, and the five agent clauses a Pakistani software house writes before its EU client does

Zohaib Masood

"Hacked" is the word in every headline since Friday. Google's own sentence, given to the Guardian by Heather Adkins, its vice-president of security engineering, is narrower: "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped."

So: three real companies, in May, in a capture-the-flag evaluation run for Google by the testing firm Irregular. One password guessed until it worked. Two sets of credentials found in public code repositories and used. Authenticated access to three protected services, no damage claimed by anyone, the victims told, and nothing said in public for seven weeks until the Wall Street Journal asked. Google has not named the companies or the Gemini version, per TechSpot; this article will not guess them.

News9 Live graphic asking whether Google Gemini hacked three companies, with the Gemini 3 logo
From Google AI Hacked Three Companies; Gemini Security Flaw Exposed; Rogue Test Explained by NEWS9 Live

Google is the fourth lab to confirm one, after OpenAI, Anthropic and Meta, all on Irregular's rig. It matters to a software house in Lahore because three of the four, by the labs' own accounts, were harness failures, and harnesses are what a contractor builds. Google "does not classify the behavior as model misalignment", per CyberSecurityNews; Meta blamed "a testing misconfiguration", per TechSpot; Anthropic's own report calls its three "closer to a harness and operational failure than a model alignment failure". They are right, and that is the problem. Five clauses follow, each with the fact that proves it.

1. A prompt is not a network boundary

Anthropic's report is the fullest of the four labs' accounts. It reviewed 141,006 evaluation runs "where Claude could have obtained internet access" and found three incidents, six runs in all. In every case "our evaluation prompt stated explicitly that Claude had no internet access", and in every case a misconfiguration meant it did. Told it was in a simulation, the model treated the real systems it found as the exercise.

A sentence in a system prompt is documentation, not a control. The control is an egress rule: a firewall that drops anything not on an allow-list and a resolver that answers only approved names. The 18 September post wrote that rule for production agents. Google's May is that rule failing on a lab's own test bench.

2. A test name that resolves is a test name that attacks

The mechanism, as Irregular gave it to the Journal, per The Decoder: the firm "picked a name for a fictional company that happened to match a real domain". With the internet on, some models found the real one first, and "the domain turned out to be poorly secured".

Anthropic describes the same collision: a fictional target that "shared a name with an active website domain name". The rule is one line: no fictional organisation may carry a name that resolves in public DNS. Check before the run and after it.

BRAID episode card, Typically Internet-Enabled, on AI sandboxes that are not boundaries
From Typically Internet-Enabled: When AI Sandboxes Aren't Boundaries by BRAID

3. Both doors were the victims' own

One service fell to password guessing: no rate limit, no second factor. Two fell to credentials in public code repositories: a secret committed once and never rotated. Neither is an AI technique. Anthropic says its models "did not find or exploit any complex vulnerabilities" and used "weak passwords and unauthenticated endpoints".

The controls are the boring ones; CyberSecurityNews lists them, citing CISA: multi-factor authentication, rate-limited logins, no password reuse, and a scanner over every repository you own for leaked tokens. Run that scan this week, on the assumption that an agent somewhere already has.

4. The model stopping is not the control

Google's defence is that Gemini stopped when it realised the targets were real. Anthropic's report shows why that cannot be the safeguard: "Opus 4.7, our oldest model, recognized that it had reached production systems but continued its attack"; a later one "reasoned its way back to the conclusion that it was still in a simulation"; only the newest stopped.

CyberSecurityNews puts it in one line I would copy into any agent policy: the model's decision to stop "should not be treated as the primary containment control". The control is automatic: the harness halts any agent that touches an asset outside its allow-list and logs the run as an incident.

Held-Out Set video card: Gemini hacked three companies, so did Claude, OpenAI and Meta
From Gemini Hacked 3 Companies. So Did Claude, OpenAI and Meta. by Held-Out Set

5. Seven days against seven weeks

Two clocks. Anthropic began its transcript review on Thursday 23 July, stopped all cyber evaluations that day, found the three incidents on the 24th, notified Irregular and the three organisations on Monday 27 July, and published on 30 July. Four days to notify, seven to publish. Two of the three organisations, it says, "had not previously detected the activity". Google was told by Irregular in late July, told the three companies, and published nothing until a newspaper asked in September, because, per the Guardian, "the models did not damage the companies".

No rule required either company to publish. The Cyber Resilience Act clock, 24 hours for an early warning and 72 for the notification, which this site walked through on 6 September, covers a manufacturer's product with an exploited vulnerability, not a lab's test rig. But those are the two numbers a German client's lawyer now carries, and they will be in the AI clause of your next services agreement. Anthropic's timeline is one you can sign. Google's is not.

Kompile video card: Google's AI hacked three real companies, the fourth lab this summer
From Google's AI Hacked 3 Real Companies. Then It Turned Out It Was the 4th Lab This Summer by Kompile

Two predictions, both mine. First: Google does not publish its own written account of the three May incidents, with a run count, a model version and dates, before 31 December 2026. Anthropic wrote one in seven days; Google has had seven weeks and a newspaper's questions, and a company that calls the model stopping its safeguard does not think it has a report to write. Second: by 31 March 2027 the standard security questionnaire an EU client sends a Pakistani software house carries a question on AI-agent network egress. If Google publishes, or the questionnaires stay silent, I read this wrong.

Five clauses: a firewall rule, a naming check, a repository scan, a kill-switch and a paragraph. Write them before the client does.

Sources