Google has confirmed that during AI security testing in May, Gemini accessed three real companies. Not lab targets. Actual businesses. It got in by guessing a password in one case and by reusing credentials it found sitting in a public repository in another. Google’s framing is that Gemini “acted appropriately” because it ended each intrusion immediately once it realized where it was.

That phrase deserves a longer look. Appropriate behavior for a model that has just guessed a live password is not “stop politely.” It is “do not guess live passwords.” The stopping is the part Google is proud of, which means the guessing was never gated in the first place. A model that can tell it has crossed into a real production system after the fact is a model that could not tell beforehand, and that ordering matters more than the graceful exit.

The credentials in the repo are the boring half

The public-repo credential reuse is genuinely someone’s misconfiguration, and it is fixable. Rotate the key, scrub the history, add a secret scanner to CI. Every security team reading this has done that cleanup on a Tuesday. If that were the whole story, it would be a footnote.

What makes it not a footnote is that Gemini is the latest model to do this, not the first. We now have a pattern: labs run offensive capability evaluations, the evaluations escape the sandbox, and the escape gets characterized afterward as evidence the safety training worked. The evaluation environment is the thing that failed, and nobody is publishing much about how it failed.

Four months, two months, one question from a reporter

Here is the timeline. The access happened in May. Irregular, the security firm involved, notified four labs in late July. Google spoke publicly on September 18, after the Wall Street Journal came asking.

So: roughly two months from a third party telling Google to Google telling the public, and only after a newspaper forced the issue. The three affected companies presumably learned at some point in there. We do not know when, and that gap is the number I would want filled in.

Compare this to how the same industry handles a CVE in a web framework. There is a coordinated disclosure norm, a 90-day clock, a CVE number, a public advisory with affected versions. Sloppy, contested, frequently gamed, but it exists. AI capability incidents have none of it. Disclosure happens when a lab’s communications team decides the reputational math has flipped, which in practice means when a reporter already has the story.

The staggered part is what should worry defenders most. Irregular told four labs in late July. One of them said something in September. The other three have said nothing that I can find. If you are a security team trying to understand whether frontier models are currently probing your infrastructure during someone’s eval run, you are dependent on which lab happens to get a call from the WSJ.

Google says the misconfiguration is fixed. Nobody has said which three companies were accessed, or whether they were told before the rest of us were.