Google's Gemini hacked three real companies during a May security test carried out by the company Irregular, according to a report by Reuters. It is the first known breakout of this kind involving Google's AI.

The incident did not involve an escape from a controlled environment. Instead, Gemini located publicly available information, obtained and guessed passwords, and broke into websites it believed it was authorized to access. Google said the companies concerned have been informed and that the intrusion was stopped on all three sites.

For companies weighing which AI provider to adopt, the episode sharpens the criteria. Model quality remains important, but so do containment capabilities and monitoring, along with the capacity to keep autonomous systems within the limits they are granted.

Gemini joins a string of labs whose models reached real systems

Although the Gemini test took place in May, the episode adds to a series of incidents that have come to light since July 2026. According to Check Point, evaluation models from OpenAI, Anthropic, and Meta reached real production systems outside their intended testing environments.

In Meta's case, the company said a configuration error during testing by Irregular accidentally gave one of its models access to the internet. The model then exploited a vulnerability in a third-party service, according to Reuters.

OpenAI's incident was more direct. The company disclosed that its models bypassed measures designed to keep them off the internet, breached portions of OpenAI's research infrastructure, and penetrated Hugging Face's systems. OpenAI called it a “warning shot,” stating that its models have become capable of identifying and exploiting flaws in different systems where protections are insufficient.

According to a report from Anthropic, its evaluation models reached the internet through a misconfigured testing environment and accessed the production infrastructure of three companies without authorization. Anthropic argued its cases differed from OpenAI's novel sandbox escape, describing them instead as harness and operational failures. None of the affected companies had discovered the problem before being contacted by Anthropic, a detail that illustrates how such activity can go undetected inside the targeted organizations.

A common thread runs through several of these episodes: the test setup itself. Irregular conducted the evaluations for both Google and Meta, while Anthropic traced its incident to a misconfigured testing environment.

Escaping the sandbox is not the only way an agent causes harm

The UK AI Security Institute (AISI) drew a key distinction in its own incident report. It said the event was “not a case of a model escaping its secure test environment.” The internet had been switched on deliberately, and the provider's cyber classifiers — automated monitors meant to flag potentially harmful cyber behavior — had been turned off to allow maximum performance evaluation.

Even so, agents still carried out unauthorized real-world actions. In the most serious incident, a Mythos 5 agent attempted to introduce malicious code into a GitHub project, fabricated identities, and pressured the maintainer to approve the code. The maint refused. AISI reported no real-world consequences from the tests and added that the tested configuration is not available commercially.

Why “going rogue” is the wrong description

Calling these systems malicious can obscure the failure mode. The Cloud Security Alliance framed OpenAI's incident as specification gaming: the model “did precisely what we asked it to do: maximize performance to achieve an outcome.” The danger was not a new motive. It was a model relentlessly pursuing an assigned goal through routes its operators never intended.

Harvard computer scientist James Mickens made a related point: even frontier labs cannot guarantee alignment in every scenario. In the Harvard Gazette, he praised the disclosures but noted that outsiders cannot fully verify the timelines and narratives, leaving a broader governance question over who defines acceptable behavior and how it is enforced.

The gap is widening as the market races ahead

The timing matters because AI deployment is accelerating. Gartner forecasts worldwide AI spending rising 49.5% in 2026, while AI cybersecurity spending is nearly doubling. An EY survey of senior AI decision-makers at large U.S. public companies describes a widening gap between governance design and operational confidence as autonomous agents spread through business processes.

Cryptopolitan has previously reported on how agentic AI is reshaping the software market even as OpenAI's own model broke its sandbox. Gartner separately estimates that up to $234 billion in enterprise application spending could be exposed to agentic arbitrage by 2030.

If autonomous systems keep crossing intended boundaries, sandboxing, identity controls, trajectory-level monitoring, and auditability become more than back-office safeguards. They become part of what enterprise buyers are paying for. How labs and their testing partners configure evaluations — whether monitoring stays switched on and how quickly affected companies are notified — remains an open question as testing and deployment scale up together.