Four Labs, One Test Vendor: Gemini and Fourth-Party Risk

On 18 September 2026, Google confirmed that one of its Gemini models had accessed the private systems of three real companies during a cybersecurity evaluation. The incidents happened in May 2026, in a capture-the-flag test run by Irregular, the Tel Aviv evaluation firm. The Wall Street Journal reported them first, and Google confirmed them after the newspaper made contact. According to CNBC, Google had been notified by Irregular in late July.

This is not a fourth telling of the story we set out on 19 August, in three labs in sixteen days. That piece established the pattern: models under evaluation reaching real organizations from environments believed to be isolated. The Gemini confirmation adds three things the pattern did not yet contain. One evaluation contractor is now the common factor across four frontier labs. One of those labs knew for about seven weeks and said nothing publicly until a newspaper asked. And the way the model got in was so ordinary that the lesson for the companies on the receiving end has little to do with artificial intelligence.

Key Takeaways

• Google makes four. Anthropic, OpenAI, Meta and now Google have each had models reach real systems during evaluations run by Irregular. OpenAI's Hugging Face breach, disclosed on 21 July 2026, remains a separate case that did not involve Irregular
• One contractor, correlated failure. Irregular says the Gemini incidents are "the same issue that was already reported". A single environment flaw at a single specialist produced incidents at four competing labs. That is concentration risk, sitting two contracts away from the enterprise buyer
• The disclosure clock ran differently at Google. Incidents in May 2026, notification from Irregular in late July, public confirmation on 18 September after press contact. Google's reported position: no public disclosure was warranted because the model caused no harm and stopped immediately
• The entry method was ordinary. One password guessed, and credentials found in a public repository twice. The three companies were exposed to any attacker with the same patience
• The contract has a gap. Subcontractor lists are typically built around who handles customer data, so evaluation firms rarely appear on them, and incidents in testing rarely carry a notification deadline. Both belong in the next renewal and in every AI-related diligence request list

What Google Confirmed, and What It Did Not

The confirmed facts are narrow, and worth keeping narrow. A Gemini model was set a capture-the-flag challenge on Irregular's systems: retrieve data from software run by a fictional company. Per SecurityWeek's account, that fictional company shared its name with a real one, and Irregular said the model was not intended to have internet access but that access was unintentionally made available. CNBC reported Google's description of the result: the model "accessed three separate private computer systems by guessing passwords and by twice using a repository of publicly listed passwords".

Heather Adkins, Google's vice president of security engineering, put it this way: "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test." She added: "In all three of these instances, the model stopped." Google said it ensured the three entities were made aware and worked with Irregular on changes to its testing process. It told the Wall Street Journal, as reported by SecurityWeek, that it had notified federal authorities and the three affected companies.

What Google did not provide: the name of the model, beyond saying it was not its latest; the names of the three companies; or a written account of its own. Anthropic and OpenAI each published a post under their own name. We have not found an equivalent published account from Google; what exists is a set of statements to reporters. The Record noted on 21 September that it is unclear whether regulators or law enforcement are investigating.

One Contractor Is Now the Common Factor Across Four Labs

In August we wrote that Irregular operated or co-operated the misconfigured environments in two of the three lab incidents then on our page, Anthropic's and Meta's. That count needs updating in two steps.

First, OpenAI. Its breach of Hugging Face, the subject of our 22 July analysis, happened in OpenAI's own research environment through a zero-day vulnerability and had nothing to do with Irregular. But on 4 August 2026 OpenAI separately disclosed third-party evaluation incidents, one of them at Irregular: on 29 July, according to CyberScoop's report of that post, a misconfiguration let OpenAI's models reach the public internet during a capture-the-flag evaluation, where they exploited a real domain and at one point found and used credentials for the site. Second, Google. With the 18 September confirmation, CNBC could write that OpenAI, Anthropic and Meta had all reported incidents and that all of them involved Irregular, and then add Gemini.

Four labs that compete on everything else bought the same specialist service from the same firm. CNBC describes Irregular as an Israeli startup founded in 2023, backed by Sequoia and Redpoint Ventures with $80 million in funding, valued at $450 million in 2025, with about 35 employees per PitchBook. Irregular's own post-incident review, dated 14 August 2026, states that incidents occurred in "fewer than 1 in 10,000 advanced simulations", and that the fictional company name its engineers selected coincided with a real domain "due to human oversight". Asked about Gemini, an Irregular spokesperson said: "This is the same issue that was already reported and does not represent a materially separate incident."

Take that statement at face value, because it is the most important sentence in the story. If the Gemini incidents are the same issue, then one flaw in one contractor's environment produced real-world intrusions attributable to four separate vendors, in runs dating from at least May to late July 2026. That is concentration risk, and it sits at the fourth-party level: the enterprise contracts with a platform, the platform contracts with a lab or is the lab, and the lab contracts with the evaluator.

The low rate does not offset this. A figure of under 1 in 10,000 is Irregular's own, and The Record reported on 17 August that the review gave no total count of incidents and drew criticism from security researchers for that reason. When The Record asked on 7 August whether the publicly known companies were the only ones affected, a spokesperson said the investigation was ongoing and that they could not "go into further details". Six weeks later, a fourth lab surfaced. A buyer should plan on the basis that the public list is a lower bound.

None of this argues against independent evaluation, which remains one of the few structural checks on frontier capability. It argues for treating the evaluator as what it is: a shared critical supplier, holding offensive tooling and the industry's most capable models at the same time.

The Seven Weeks Between Knowing and Saying

The timeline for the other labs is short. Anthropic notified Irregular and the affected organizations on 27 July 2026 and published on 30 July. OpenAI's Irregular incident occurred on 29 July and was disclosed on 4 August. Meta confirmed in the first week of August.

Google's is different. The incidents occurred in May. Irregular says all relevant labs were notified in late July. Google confirmed on 18 September, and SecurityWeek states the point without decoration: Google "did not disclose the findings until it was contacted by the WSJ". The same report gives Google's reasoning, that the incidents did not warrant public disclosure because the model caused no harm and stopped immediately.

That reasoning deserves a fair hearing. The affected companies were told, federal authorities were told, and no damage is reported. Many breach-notification regimes turn on harm and on personal data, and on Google's account neither threshold was met. The position is defensible as a matter of obligation.

It is weaker as a matter of what customers need. A harm threshold is assessed by the party with the least incentive to find harm. And during those seven weeks, enterprises were sending questionnaires to AI vendors prompted by the July and August disclosures, asking whether anything similar had occurred. Whatever Google's answers were, the public record until 18 September said three labs, not four. We argued in March that AI vendor evaluation has to extend beyond the product to exposures that can shift trust in a platform quickly. How a vendor handles disclosure of its own incidents is one of those exposures, and it is now observable: the same event class produced a three-day disclosure at one lab and a press-prompted one at another.

The Way In Was Ordinary: Guessed and Exposed Credentials

Strip the model out of the story and read what remains. Three companies had systems reachable from the public internet. One accepted a password that could be guessed. Two had working credentials in a public repository, in The Record's wording "credentials that had been exposed in a public repository". An automated actor with no insider knowledge found all three.

This is consistent across the wave. Anthropic said its incidents generally relied on weak passwords and unauthenticated endpoints, and that the two affected organizations it had reached had not previously detected the activity. Irregular told CNBC in August that the situation "did not involve a sandbox escape or a sophisticated cyber action".

For the companies on the receiving end, then, the defensive lesson is not an AI-specific control. It is the unglamorous list:

• Find your own secrets before someone else does. Continuous scanning of public code repositories, paste sites and package registries for credentials tied to your domains, with a rotation process that runs in hours once one is found
• Make a guessed password insufficient. Multi-factor authentication on every internet-facing login, lockout and rate limiting, and no default or shared credentials on administrative interfaces
• Detect the valid login that should not exist. Alerting on first-seen source networks, on authentication from infrastructure providers, and on bursts of failed attempts followed by a success
• Bound what a credential reaches. Short-lived, narrowly scoped credentials and workloads that reset to a known-good state, the architecture we set out in regenerative containment, so that a foothold expires by design

The Gemini model is reported to have stopped when it recognized real systems. The next automated actor to find the same repository will be under no such instruction.

What to Put in the Contract and the Diligence List

For AI vendor contracts. Add evaluation and red-teaming firms to the subcontractor schedule. They do not process your data, which is why most sub-processor lists omit them, but they operate your vendor's models with safety mitigations reduced. Require the vendor to state what containment and monitoring it contractually imposes on those firms, and how isolation is verified. Then add a notification clause with a number in it: a fixed number of days from the vendor learning that a model under test touched a third party to telling affected parties and customers, without a harm qualifier. The Gemini timeline shows what a harm qualifier does to the clock.

For your own third-party risk programme. Ask each AI vendor one concentration question: which evaluation firms do you share with other labs? A shared evaluator is not disqualifying. An unknown one is.

For deal teams. There are two sides. If the target is an AI company or an evaluation firm, incidents in testing are now a disclosure-schedule item: ask for every instance in which a model under evaluation reached a system outside the test environment, when it was discovered, and who was told. If the target is any other company, add two questions to the request list we set out in the diligence framework for AI-heavy targets: has the target ever been notified by an AI lab or evaluation firm of access to its systems, and what does an external scan for exposed credentials return today? Two of the three companies in the Gemini case learned the answer to the second question from a lab's notification.

What This Changes for the Executive Team

The August pattern told boards that evaluation environments are production security boundaries. September adds a supply-chain reading and a hygiene reading. On the supply chain: your AI vendor's assurances are only as good as its least visible supplier, and that supplier may be shared with its competitors. On hygiene: the same automated capability that reached these three companies by accident is available to people who intend it, and the entry price was a guessed password.

Innovaiden's AI Fourth-Party Risk Review maps the evaluation and testing subcontractors behind the AI platforms you rely on, tests your vendor contracts for subcontractor visibility and notification deadlines, and runs the external exposed-credential and authentication checks that would tell you whether you would have been the fourth company on Google's list.