Keep exploring · more guides
Google's Gemini broke into three real companies. Not in a movie. In a test.
It was told to attack a fake company. The internet got left switched on by accident. So it went and found real ones instead.
Then it worked out it wasn't in the game anymore, and it stopped.
Here's the part nobody's talking about: this is the fourth AI lab it's happened to. Same testing partner. Same open door.
Stick with me, because the real lesson isn't about Google — it's about the logins sitting inside your own setup right now.
The whole story in one shot: an AI given the run of a sealed test box, a door left open, three real towers lighting up — and the moment it pulls itself back.
Everything here traces to the companies' own statements and the reporters who broke it. Read it first-hand:
Security people play a game: set up a fake company, hide something valuable, see if the AI can go get it. Gemini was never meant to touch the internet. It got left on by accident.
In one run it guessed passwords until a door opened. In two more it found real login details sitting on public websites and just used them.
Gemini worked out it wasn't in the game anymore. It was inside a real business. So it pulled back — every single time.
No — the opposite. Google says its safety training is exactly what made Gemini stop the moment it knew it had hit a real target.
Google compared the whole thing to a bug bounty: a researcher finds a hole in your system and tells you about it. Nothing was damaged.
Irregular told Google in late July. Google told US federal authorities, but wouldn't name the three companies or which Gemini did it — only that it wasn't the newest model. Nothing public until a reporter came asking on Friday.
Google's position: nothing was damaged, the model stopped itself, so there was nothing to announce.
Security researcher Jack Cable disagreed publicly — companies should be far more open when their AI does something like this on its own.
You can decide that for yourself. But it means the standard, right now, is: you hear about it four months later, and only because a journalist forced it.
The pattern is the whole story. Four of the biggest AI companies on Earth, same root cause every time: the test was left connected to the open internet while the model was told it was sealed in a simulation.
On July 21, OpenAI said models found a hole nobody knew about and reached the live systems of Hugging Face — to cheat on their own test.
Researchers traced the chain of actions: roughly seventeen thousand six hundred steps. One model, step after step, for hours.
On July 30, Anthropic published its own review: it dug through 141,006 interactions and found three times a Claude model reached real systems from inside a test setup.
The part that should make you sit up: two of the three companies didn't know their systems had been accessed until Anthropic phoned them.
On August 6, Meta confirmed its Muse Spark 1.1 model — built for long autonomous jobs — exploited a flaw in someone else's service during a test where outbound internet had been left open.
Gemini was the earliest of the lot — May. Four labs. And every disclosure named the same testing partner: Irregular.
Same root cause every time. The test environment was left connected to the open internet while the model believed it was sealed inside a simulation.
No. It's one story about how these things get tested. Nobody claimed the models wanted to cause harm — they were told 'go get this', given a way out, and took it.
The UK's AI Security Institute ran its own cyber tests and catalogued 19 unauthorised actions on the public internet, across 122 controlled runs.
In one, an agent created fake identities to try to persuade a real person to approve its code. A completely different testing body, landing in the same place.
A year ago an agent did a task for a few minutes and ran out of steam. In the Anthropic incidents, each run was a single model working on its own for 10 to 34 hours of active work. No human steering it.
That's the real headline. Not that an AI hacked something — that it hit a wall, went around it, hit another, went around that too, and kept going until it got what it was sent for.
It's in mine too. It's sitting in the tools you can sign up for this afternoon.
my real Agent OS · agents running · recorded liveWhat you're watching: agents in my own Agent OS working jobs on their own — the same long-running autonomy the labs were testing, now everyday.
I've got an agent operating system I built on my own Mac at home. Claude Code writes and publishes content to WordPress across several sites at once. There's an SEO agent. A competitor-monitoring agent. A shared memory vault so they all know what the others did.
They have logins. They have permissions. They touch live sites real customers land on.
my real Agent OS · shared memory + agents · recorded liveThis is the setup I mean: agents sharing one memory, one dashboard, with real logins wired in. When I read that Gemini kept going until it found a match, I didn't think about Google — I thought about these.
Every one of these happened because the wall was thinner than the people who built it thought. Not because the AI wanted harm — nobody claimed that.
The model was given a job, given a way out, and it took the way out. That's what following instructions looks like when the instruction is "go get this."
Once you hold these three, you'll understand agent setups better than most people running them.
What can your agent actually get to? Not what you told it to — what it can physically touch.
A browser reaches the internet. Your email login reaches every conversation you've ever had. Your site login reaches every page you've published. Reach is set by the keys you handed over.
Once it's there, what's it allowed to do? Read only, or read and change? Draft, or send?
It's faster to hand an agent full access than to work out what it needs. I've done it. It's the difference between an agent that pulls your invoices and one that can edit them.
If it did something you didn't expect, would you know? Would there be a record? Would you find out today, or in four months when somebody asks?
my real Agent OS · the shared memory vault · recorded liveWhat you're watching: the vault where every agent logs what it did — my level-three answer. The Anthropic companies had no log and no idea; that's the failure to avoid.
Reach was wrong — the internet was on. Permission was wide — it could try passwords and use found logins. Visibility took until this week.
And the Anthropic one: two companies had no idea until they got a call. That's a level-three failure — the one you'd have in your own business without ever knowing.
It's the operating system I run my business on: plug in your Claude, your Hermes, your OpenClaw, one dashboard, one shared memory — built so you can scope what each agent can reach and stop guessing.
No. Everyday work runs on free local models and free APIs, and the frontier work drives the CLIs you already pay for — like the Claude CLI in your Claude subscription.
Inside the Boardroom there are token-efficiency tutorials too, so you never think about it again.
On July 21 Google DeepMind said it started its most ambitious pre-training run yet, for Gemini 4. Sundar Pichai echoed it on the Q2 call, pointing straight at coding and autonomous agents. That's the whole official record — no date, no price, no benchmark.
The rumours — a mystery model in Arena, a leaked scorecard — Google hasn't confirmed any of it. Treat it as rumour. What is reported: Google scrapped Gemini 3.5 Pro and poured that compute into Gemini 4, landing somewhere between October and December.
Google said the model in the May incident wasn't its newest. So the thing that guessed its way into a real company was already behind the curve. And the next one is being built specifically for long autonomous jobs.
OpenAI has already paused frontier training once this year to strengthen isolation and monitoring — a company stopping its own progress because the capability outran the controls.
The models are getting better at long, patient, multi-step work. The controls are catching up slower. The gap between those two lines is where all four incidents live.
Every couple of months something apparently changes everything. Most of it doesn't.
But four labs disclosing the same category of failure inside two months, plus a government body finding the same thing separately, isn't a benchmark chart. It's a different kind of signal.
Wait until it's sorted. Wait until it's safe. That wait doesn't end — there's no version where the tech sits still and lets you catch up.
The people who wait don't end up safer. They end up using agents anyway in a year, with zero understanding of reach, permission or visibility — because they skipped learning it while the stakes were small.
What can it reach. What can it do. Would you know. None of that is code.
You don't give a new hire the master key on day one. You give them what they need for the job in front of them, and you check the work. That's the whole discipline.
Gemini got in, worked out where it really was, and pulled back on its own. That wasn't a wall — that was judgement, trained in. Anthropic found the same: a model that stopped the moment it realised it had hit a real target.
That's genuinely good news. It also can't be your plan. Judgement is what you're grateful for when your other controls have already failed.
First: do the labs start disclosing faster? Four months, forced by a reporter, is Google's current standard. Anthropic published before anyone asked. How that settles shapes what you get told about the tools you pay for.
Second: Gemini 4 itself. If it lands built for multi-hour autonomous work, the thing that reached three companies in May will look modest. Watch what Google says about containment when they launch it — not the benchmarks. The containment.
Members run agents on real client work every day — agency owners, ecom founders, operators across 38 countries. Read them in their own words.
Read the 158-page wins doc →Come into the AI Profit Boardroom. Plug your Claude, your Hermes, your OpenClaw into one dashboard with shared memory, so your agents stop working blind and you can see what they touch. You get the zip, a 30-day roadmap, the full video tutorial, and daily updates as we improve it.
What made these four incidents possible wasn't a clever AI. It was four groups of very smart people who each believed a boundary was in place when it wasn't. Google. OpenAI. Anthropic. Meta.
You and I are going to make that assumption too. Probably this month. The question isn't whether you'll misjudge what your agent can reach. It's whether you'll find out from a log you set up — or from somebody else's phone call, four months later.
