How did AI models hack three companies by accident?

A containment error gave security-test agents access to the real internet and ambiguous target names pointed them at real companies.

During a May 2026 security evaluation, a third-party company gave experimental Gemini models internet access when the test was meant to be isolated. Fictional target names overlapped with real organizations, and the models reached three companies—using a guessed password in one case and publicly exposed credentials in two others—before stopping when they recognized the mismatch. Google confirmed the incidents in September and said the companies were notified.

The unsettling lesson is about containment: capable agents need strict network boundaries, unambiguous targets, and human stop points before a test begins.

Why containment matters more than cleverness

An AI agent does not need bad intentions to cause real harm. If it can browse, guess passwords, and try logins, a misunderstanding about where it is can become a real intrusion. Tests are supposed to be safe sandboxes where mistakes cost nothing. When the sandbox leaks and its invented names match real organizations, practice stops and real people are affected.

What to do, step by step

1. Confirm the test environment has no route to the public internet before any agent runs.
2. Use invented names and addresses that cannot match any real company or person.
3. Give agents the least access needed, with logging and a human stop button.
4. If a model reaches anything real, halt it, preserve records, and notify those affected.