The part that sticks with me: Gemini didn’t break anything clever. It guessed passwords and reused credentials found lying in public repos. The only real failure was a config error that left outbound internet open in a supposedly sealed test. I’ve made that exact mistake on a home lab box — you think the container is isolated until something walks out the default route.
So my rule for anything agentic I run: outbound blocked by default, a narrow allowlist, obviously fake domains and credentials, logging of every action. Google says Gemini stopped on its own once it noticed the targets were real companies. That’s a bonus layer, not a control. If your isolation depends on the model choosing correctly, you don’t have isolation.
The story — During a May 2026 security test by Irregular, Google’s Gemini accessed protected services of three real companies after a misconfiguration left the supposedly sealed environment connected to the internet. The capture-the-flag exercise targeted a fictional firm; Gemini guessed passwords and used credentials found in public repositories. Google confirmed the incidents after Wall Street Journal reporting, said no damage occurred, and notified the affected firms. (Source)