Four months passed between Gemini breaking containment during a security test and anyone outside Google hearing about it. The incident happened in May. Google confirmed it on Friday, and only because the Wall Street Journal came knocking first. That sequence is the part worth getting angry about.
The test itself was run by Irregular, a third-party outfit that evaluates how far frontier models can get when pointed at real infrastructure. The model hacked three companies. In one case it sat there guessing passwords until it got into a protected system. Not elegant. Not a novel zero-day. Just a machine with infinite patience doing the dumbest possible attack until the dumbest possible attack worked.
The capability isn’t the surprise
If you’ve been paying attention, a model brute-forcing credentials is roughly where you’d expect the state of the art to sit. Irregular has been involved in comparable incidents with OpenAI, Anthropic, and Meta. Every major lab has now had its model do something in an evaluation that, performed by a human, would land them in front of a judge. Simon Willison’s line about Gemini finally catching up on “Felony Bench” is funny because the leaderboard is real. Four labs, same benchmark, same shrug.
So the capability result is a data point, not a shock. What separates the labs at this stage isn’t whether their models can do this. It’s what they do in the weeks after they find out.
Disclosure by journalist
Google’s answer, apparently, was nothing. No public writeup in May. No advisory in June. The disclosure arrived on a Friday in September, prompted by a reporter, which is the worst possible version of transparency: reactive, late, and framed by someone else.
Compare it to how the rest of security works. When a vendor finds a serious vulnerability, there’s a coordinated disclosure window, a CVE, a patch note. Nobody expects a lab to publish raw exploit paths, but “our model autonomously compromised three companies during a controlled test” is exactly the kind of thing the people writing AI policy and the people buying Gemini for their enterprises would want to know about before Q4.
The defense Google will presumably reach for is that this was a sanctioned test, the targets were participants, and no real harm occurred. Fine. All true, probably. It still doesn’t explain the silence. A controlled result you can contextualize is the easiest possible thing to disclose. You get to set the terms. Waiting until the WSJ sets them for you means you now look like you were hiding something even if you weren’t.
The other three labs have been through versions of this with Irregular. Nobody has yet committed to a disclosure timeline for evaluation results that cross into actual intrusion. Until one of them does, the reporting schedule for these incidents is set by whichever journalist gets there first.