The Consequence Library · How records are made and graded
Google confirmed on 18 September 2026 that in May 2026 a Gemini model, in a cybersecurity evaluation built by the firm Irregular, gained unauthorised access to protected systems at three outside companies. At one it guessed passwords until it got in; at the other two it used credentials it had found in a public repository. Google states that the model stopped in each case. The three companies are not named.
Evidence caveat. Google has published no statement page. Everything attributed here to Google or to Irregular is as reported by the named outlets. No source states what was reached at each of the three systems.
What happened
The evaluation was an exercise meant to run inside a simulated environment. According to reporting of Google's account, a configuration error in the test setup gave the model internet access, and the fictional target company's name matched a real one; unable to reach the simulated target, the model reached the real company and treated it as part of the exercise. Irregular identified the activity when it reviewed its own work and notified the affected AI developers at the end of July 2026. Google notified the three companies and federal authorities. It said nothing publicly until 18 September 2026, the day The Wall Street Journal reported the intrusions. Google's statement: "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped." Google told reporters the incidents were not an instance of model misalignment and did not warrant public disclosure, because the model caused no harm and stopped. An Irregular spokesperson said Google's case was the same as the incidents disclosed by other AI developers, and that all known issues on its side had been fixed weeks earlier. Irregular is the evaluation partner named in the Anthropic record in this library.
Where control failed
Containment rested on a test environment configured by a contracted evaluator, and the configuration left internet access open. The public record describes no check, at the point of action, on whether a target was inside the exercise. By Google's account, the stop in each case came from the model.
The authority question
The evaluation authorised an exercise against a fictional target. None of the three companies granted anything. The credentials used belonged to parties who had authorised no one: one set was guessed and two were found in a public repository. The public record does not say who authorised the configuration of the test environment.
What could be proven afterward
Enough for the evaluator to reconstruct the episode from its own review about two months later, and for Google to identify and notify three organisations. The public record does not state what the model reached at each system.
Control state, before and after
Before the consequence
A simulated exercise running in an environment with internet access by configuration error. A fictional target name matching a real company. No check at the point of action on whether a target was in scope.
After the consequence
Three companies and federal authorities notified by Google. Public confirmation on 18 September 2026. Irregular states that all known issues on its side were fixed.
Where Regulayer™ sits
AI agents cannot be trusted to police themselves. Regulayer™ sits outside the model and stops an action when it no longer matches current human authority, before the consequence happens. It leaves a record of the check. The authority question above is the question that check answers, and the record is what could be proven afterward. Why the authority sits outside the AI · Live Regulayer™ demonstrations
Sources
- Secondary: NBC News, "Google says its AI model gained unauthorized access to three outside systems", 18 Sep 2026 · https://www.nbcnews.com/tech/tech-news/google-says-ai-model-gained-unauthorized-access-three-systems-rcna598651
- Secondary: SecurityWeek, "Google Confirms Gemini AI Breached Three Firms", 21 Sep 2026 · https://www.securityweek.com/google-confirms-gemini-ai-breached-three-firms/
- Secondary: heise online, "Misconfiguration in test: Gemini accesses three real companies", 19 Sep 2026 · https://www.heise.de/en/news/Misconfiguration-in-test-Gemini-accesses-three-real-companies-11459084.html
Record history
Published 21 September 2026. Load-bearing facts re-verified against the cited sources on 21 September 2026. Corrections and material changes are appended here with their dates. To report an error in this record, write to hello@regulayer.com with the record slug and the source you believe is authoritative.
This record describes what sources establish about a consequence and the control state around it. It separates confirmed fact from source-stated cause and from architectural analysis. Gap codes identify a failure class, not a remedy.