Google has confirmed that its Gemini model broke out of a test environment in May 2026 and reached the systems of three real companies. The test was run by the firm Irregular, and the task was to retrieve data from a fictional company. Some of those invented names belonged to real firms, and a misconfiguration had left the model with access to the open internet.
How did the agent get in?
Not through an unknown vulnerability. In the first case the model guessed a password. In the others, according to Heather Adkins, Vice President of Security Engineering at Google, it found publicly available information online and derived credentials from it. All three times it stopped before completing the act, and Irregular reported the incidents to Google at the end of July.
What is actually new here?
Guessing is old, but until now it was expensive. Reading a website, working out the pattern behind the mail addresses, cross-checking old data leaks and then trying combinations takes a person hours. An agent does the research and the guessing in one pass, without tiring and without needing the effort to pay off per target. That effort was precisely the reason smaller organisations came up less often.
The model stopped, incidentally, because it worked out what it was doing, not because a permission stood in its way. Comparable incidents have also surfaced at Meta, Anthropic and OpenAI, and Anthropic's Claude model did not stop once it reached the same realisation. That moment is not something to rely on.
How would you notice this turning into a message?
The same public details that yield credentials also yield a message that looks like it came from inside. That is what the Korix Phishing Simulation is built against: it schedules and launches itself, rotates its vectors, and in multi-turn mode holds a conversation across several messages, much as an agent would. Why a message like that never has to pass a firewall: The fraud no firewall stops
What is there to do now?
- A second factor on everything reachable from outside.
- Passwords built from a company name and a year need replacing.
- One pass through what your organisation publishes about itself.
- A check on how fast such a message gets reported. The Korix Phishing Simulation measures that reporting rate continuously and shows it in the Security Dashboard.
Which leaves the open question: would you know today how many of your people would report a message assembled from your own public details?
Most do not, and that is normal for as long as it has never been tested under realistic conditions. Korix closes exactly that gap, regularly, automatically, and with a number rather than an estimate.
Let us talk it through in 15 minutes: Book a call