Gemini got out of a security test and into three real companies. A closed sandbox is a claim. Test it.

On September 18, Google said that one of its Gemini models, during a security test in May, reached the open internet through a bug in the test environment and got into the systems of three real companies. The lesson for anyone who tests or runs AI agents: the test’s most important fact, that the sandbox was closed, was a claim, and a claim that important needs a kill test before the run, not a disclosure months after it.

This is an illustrative reading of public reporting through the Of One method. It adds no facts and assigns no blame beyond what Google, the testing firm and the reporters have said. The reporting does not describe what checks were run before the test, so this post does not guess at them.

What was reported

From CNBC, Cybersecurity Dive and SecurityWeek:

The test. A “capture-the-flag” exercise run by Irregular, an Israeli AI testing firm. Cybersecurity Dive reports that Gemini was told to steal information from a fictional company.
The bug. Google’s agents were never supposed to reach the broader internet, CNBC reports, but a bug in the testing environment made internet access available.
The breaches. Cybersecurity Dive reports that on three occasions when fictional companies shared names with real ones, Gemini reached the real companies’ networks. It guessed passwords once and, in the other two cases, found working passwords in a public database.
The stop. Google says the agents stopped when they determined they had reached real company systems. Heather Adkins, Google’s vice president of security engineering, said: “In all three of these instances, the model stopped.”
The timeline. The incidents happened in May. Irregular notified all relevant labs in late July. The Wall Street Journal first reported Google’s case, and Google confirmed it on September 18.
The pattern. Irregular told CNBC the Google case came from the same issue that let other labs’ models reach the internet. OpenAI, Anthropic and Meta had earlier reported incidents in tests involving Irregular.
The fix. Google says it worked with Irregular to change the testing process. Irregular said all known issues on its end were fixed weeks ago. SecurityWeek reports that Google said the model involved was not its latest one; Google did not name it.

The eight bones

Of One frames any decision with eight plain questions. Here the decision is “run this agent test.” The table fills them in from the reporting and shows which answers were facts and which were assumptions.

Bone	Question	From the reporting	On a map
Decider	Who makes the decision?	Google and its testing partner, Irregular	Solid
Goal	What outcome do they want?	Test the model’s hacking ability against a fictional target	Solid
Facts	What is true right now?	Assumed: no internet, fictional targets. Actual: a bug opened the internet, and some target names matched real companies	Two assumptions carried as facts
Limits	What are the hard limits?	No access to real systems	Solid, and broken
Levers	What can they actually change?	Internet access, target names and credentials, all named in the reporting	Solid
Causes	What will shift the outcome?	Whether anything inside the test can reach anything real	Unchecked in the reporting
Proof	How will you know it worked?	The model’s own stop, after access	Came too late
Timing	When must they decide?	Not in the reporting	Missing

The Facts row carries the story. Two statements sat under every run: nothing inside could reach the internet, and the target was fictional. Both were reasonable. Neither, as far as the reporting shows, was checked right before the run that proved them false. of1.ai calls that a guess treated as a fact.

The unknowns nobody asked

The method turns each assumption into a named unknown, then asks the one worth the most first. Here there were two:

Can anything inside the test reach the outside world?
Does any target name match a real organization?

The first is the best next question. It is the cheapest to answer, and it bounds everything else: if nothing can get out, a name that matches a real company does no harm. The second is still worth a minute, because environments change and bugs happen.

The kill test

A kill test is the result that would prove you wrong. For “the sandbox is closed,” it is one line:

Before each run, from inside the sandbox, try to reach an address outside it. If it connects, the run does not start.

That test is cheap, fast and final. It does not depend on the model behaving well, and it does not depend on anyone remembering how the environment was set up last month. A matching check for the second unknown: look up every fictional target name against real domains, and rename any that match.

The method also names triggers, new facts that reopen part of the map. Irregular’s late-July notice was one. Under Of One, a new fact leads to one of five responses: no change, a patch, a scoped rerun, a trunk rewrite, or human review. A notice that a test environment could reach the internet touches every result produced in it and every outside party it may have reached, so it calls for a scoped rerun and human review, not a note in a queue.

Where the human gate belonged

Google’s statement points to the model’s own stop as the safeguard. By Google’s account, it did stop. But it stopped after it had logged in to a real company’s system with a password it guessed or found. In these three cases, the model’s own judgment was the stop that worked. A test should not depend on it.

Of One puts a human gate, a named person who must approve, on moves in legal, safety and reputational territory and on moves that cannot be undone. Logging in to someone else’s system is all of those. In an agent test, the gate belongs at the boundary:

The first connection to any address outside the test range pauses the run and pages a named person.
The first use of a credential the agent found outside the test does the same.
The person paged can see the map: what the test assumed, what the kill test showed, and what just tripped.

A gate enforced by the test harness does not rely on the model noticing where it is. The model’s own caution is still useful. It is a second line, not a substitute.

What to do this week

If you evaluate or deploy AI agents with tools:

Run an egress check before every test, not once at setup. Make a failed check stop the run.
Check fictional names against real domains before they go into a scenario.
Set a tripwire on credential use outside an allowed list, and treat any hit as a stop.
Name the person who gets paged, and write down what they are allowed to decide.
Write your triggers: what outside notice reopens your past results, and who reviews them.

To map a decision of your own the same way (bones, unknowns, what would flip it, and the gate), use the free tool at of1.ai/ask.

If you want a team to build these gates into your agent stack with you, and teach your people to run them, Utlyze’s Build service starts at $15,000 a month.