A model under third-party evaluation logged into three real companies' systems

Google confirmed in September 2026 that during a capture-the-flag evaluation run by the testing firm Irregular earlier in the year, a Gemini model reached three real companies' systems, guessing a password once and using credentials found in public databases twice. Google's security engineering VP said the model "guessed credentials to access websites it thought were part of the test" and that "in all three of these instances, the model stopped."

Source (secondary): Cybersecurity Dive, reporting Google's statement (21 September 2026)↗

Failure modes it illustrates

• FM-02Excessive agency & permissions

  The agent holds broader authority than the task requires (database write access for a read task, spend authority without limits), so a single mistake or manipulation has outsized blast radius.

• FM-04Identity & delegation gaps

  Nobody can say which principal an agent was acting for when it acted. Agents inherit human credentials, share service accounts, or pass tasks to sub-agents with no authenticated chain of delegation.