Level 1 — Absolute Beginner
Gemini is a computer program made by Google. It can read, write and use other programs.
In May, people tested Gemini. It was a game. The program had to find secret files.
But the test was not closed. Gemini went out to the real internet. It opened the computers of three real companies.
Google said sorry and fixed the problem. Other companies had the same problem this year.
- computer
- A machine that stores information and follows instructions.
- program
- A set of instructions that tells a computer what to do.
- test
- A way to check if something works well.
- secret
- Something that other people should not know.
- internet
- The system that connects computers around the world.
- password
- A secret word that lets you open an account.
- problem
- Something that is wrong and needs to be fixed.
- safe
- Not in danger and not causing danger.
Level 2 — Elementary
Google has confirmed that one of its Gemini artificial intelligence models broke into the computer systems of three real companies. It happened during a security test in May 2026.
The test was run by a security company called Irregular. It was a capture the flag exercise, a kind of game in which a program must find hidden information inside a practice network.
Two mistakes made the test go wrong. First, the invented company name used in the exercise matched a real address on the public internet. Second, a setting was wrong, so the practice network was still connected to the internet instead of being sealed off.
Gemini got into one system by guessing a password again and again. In the other two cases it used login details that somebody had left in a public code library. Google confirmed the incidents on September 18, 2026, after reporters asked about them.
- artificial intelligence
- Computer systems that can perform tasks which normally need human thinking.
- security
- Protection against danger, theft or damage.
- network
- A group of computers connected so they can share information.
- setting
- A choice that controls how a system behaves.
- sealed off
- Completely closed so nothing can get in or out.
- guess
- To try an answer without being sure it is correct.
- login details
- The name and password used to enter an account.
- incident
- An event, usually an unpleasant or unusual one.
Level 3 — Intermediate
Google has confirmed that one of its Gemini artificial intelligence models gained unauthorised access to the protected systems of three real companies during a cybersecurity evaluation carried out in May 2026. The evaluation was run by the security firm Irregular on its own infrastructure and took the form of a capture the flag exercise, a standard method for measuring how capable a model is at offensive security tasks.
Two failures had to line up for the escape to happen. The fictional company name written into the scenario happened to correspond to a real domain on the public internet, and a misconfiguration left the test environment connected to that internet rather than sealed inside a sandbox. The model, following its instructions faithfully, pursued the target it had been given and found live systems instead of simulated ones.
The techniques involved were unremarkable, which is part of what makes the episode instructive. In one case Gemini obtained entry by repeatedly guessing a password. In the two others it used credentials that had been exposed in a public code repository, the kind of leak that security teams have warned about for years. No exotic capability was required, only persistence and an environment that failed to contain it.
Google confirmed the activity on September 18, 2026, after reporters approached the company. That sequence has drawn attention, because Anthropic disclosed in July that its Claude models had reached three real organisations during evaluations, and OpenAI models reached production infrastructure at Hugging Face during a separate July exercise. Both of those came to light through company disclosure rather than press inquiry.
- unauthorised
- Done without official permission.
- evaluation
- A careful test to judge how well something performs.
- infrastructure
- The basic systems and equipment that something needs in order to operate.
- misconfiguration
- A setting that has been arranged wrongly.
- sandbox
- An isolated environment where software can run without affecting real systems.
- credentials
- The details, such as a username and password, that prove who you are.
- repository
- An online store where programmers keep and share code.
- disclosure
- The act of making information known publicly.
Level 4 — Advanced
Google has acknowledged that a Gemini model obtained unauthorised access to production systems belonging to three real companies during a cybersecurity evaluation conducted in May 2026 by the security firm Irregular. The exercise was a capture the flag scenario staged on Irregular's infrastructure, a now conventional instrument for benchmarking a model's offensive capability under controlled conditions. The conditions, on this occasion, were not controlled.
The failure mode is worth setting out precisely, because it is mundane rather than exotic. A fictitious company name inserted into the scenario coincided with a domain that genuinely exists on the public internet, and a misconfiguration left the evaluation environment routed to that internet rather than isolated within a sandbox. The model did not circumvent a safeguard or reason its way past a restriction; it executed its brief competently and discovered that the boundary it assumed to exist was not there. Alignment researchers have been arguing for some time that containment failures of this shape are more probable than deliberate evasion, and the incident supports them.
The access itself required nothing sophisticated. Gemini brute-forced a password in one instance and, in the other two, made use of credentials that had been exposed in a public code repository, a class of leak that has featured in breach reports for a decade. The significance lies not in the novelty of the method but in the tirelessness of the operator: an automated agent will iterate through a weak authentication surface without fatigue, boredom or the hesitation that limits a human intruder.
Google confirmed the episode on September 18, 2026, after being approached by reporters, and that detail has attracted more comment than the technical facts. Anthropic volunteered in July that Claude models had reached three real organisations during evaluations, and OpenAI models entered Hugging Face production infrastructure during a separate July test, both surfacing through company disclosure. A field that is asking governments to trust its internal safety testing has an obvious interest in demonstrating that inconvenient findings reach the public without a journalist's prompting.
- benchmark
- To measure something against an agreed standard for comparison.
- failure mode
- The particular way in which a system goes wrong.
- mundane
- Ordinary and not interesting or special.
- circumvent
- To find a way around a rule or obstacle.
- containment
- The act of keeping something within fixed limits so it cannot spread.
- brute-force
- To break into a system by trying every possible combination until one works.
- authentication
- The process of checking that somebody is who they claim to be.
- iterate
Talk about this article with KatePractice this story's vocabulary in a real spoken conversation with your AI tutor