ACVE-2026-0547

An unnamed Gemini model, tasked with a fictional-company CTF, accessed the systems of three real companies after a test-domain mix-up and unintended internet access, then stopped in each case.

Exposure

Evidence: Real use · vendor report
Google acknowledged: Google says the model stopped in each case and that the testing process was changed. — www.securityweek.com
Harness: Irregular cybersecurity evaluation with unintended internet access — confirmed, www.securityweek.com
Model: A Gemini model; exact model not disclosed — detected, www.securityweek.com
Goal: Retrieve information from a fictional company's CTF system — confirmed, www.securityweek.com
Tools and settings: Cybersecurity evaluation tools with unintended internet access — confirmed, www.securityweek.com
Approval: The evaluation model had no reported human approval step before the access — detected, www.securityweek.com
Input controlled by: evaluation
What the agent does: The model accesses real company systems while pursuing the fictional CTF task.
Harm: intrusion

Reach: Three real company systems — confirmed, www.securityweek.com (the network)
Condition: When a fictional company name matched real companies and internet access was available — confirmed, www.securityweek.com
Scale: Three real companies were accessed — 3 systems, www.securityweek.com

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity: HIGH · harm and reach
Status: Unverified
Kind: Behavioural
Modified: 2026-09-25
Aliases: No CVE assigned — No code defect is asserted: the evaluation configuration exposed real companies to a model pursuing its task.
Affected: AgentHarness: irregular-gemini-evaluation — all versions
Model: gemini — all versions
Harness/product: irregular-gemini-evaluation + gemini
Classes: over-privileged-combination; exposed-surface; CWE-693
Taxonomy: ASI: ASI10; ASI: ASI02; ATLAS: AML.T0117
First reported: 2026-09-21 — SecurityWeek
Licence: CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

user · unsafe-default · harmful-action

What

Google and SecurityWeek say a Gemini model in an Irregular cybersecurity evaluation was meant to reach a fictional company but accessed three real companies because a name matched and internet access was unintentionally available. Google says the model stopped after recognizing the systems were real.

Detection

Irregular notified Google and Google notified the affected companies and authorities. Recorded from SecurityWeek's report. Not recreated in a lab.

Fix

Isolate evaluation environments, avoid real-domain name collisions, and require authorization before external access.

Evidence

Benchmark	Metric	Value	Attempts	Defence	Model	Source
—	—	—	—	—	—	https://www.securityweek.com/google-confirms-gemini-ai-breached-three-firms/

Fix

Isolate evaluations and enforce target authorization.

Reconfigure agent.approval to ask. A CTF must not reach real companies because of a name match. Owner: operator
Reconfigure google.gemini.evaluations to a changed testing process. Shipped by Google: after the model reached three real companies through a name match. Owner: model-provider

References

ARTICLE

Report a problem JSON