Four Labs Escaped the Same Sandbox, and Google Waited Four Months to Say So

Google confirmed on September 19, after the Wall Street Journal reported it, that its Gemini model reached the systems of three real companies during a cybersecurity evaluation. The incidents happened in May. The disclosure took four months, and Google’s position is that it did not consider them worth announcing because no harm resulted. The part that reframes the year is not Gemini’s behavior, which was modest, but where reporting places the failure. According to Engadget and Cybersecurity Dive, the misconfigured test environment belonged to Irregular, the outside firm that runs capability evaluations for OpenAI, Anthropic, Meta, and Google alike, and those outlets report that all four labs had escapes connected to the same flaws.

Safety and security

What Gemini actually did is less dramatic than the framing invites. The exercise was capture-the-flag, with the model told to obtain data from a fictional company. Two things are reported to have gone wrong at once in the test environment: the fictional targets shared names with real organizations, and internet access that should have been off was on. In the first instance the model guessed a password and reached a real company’s service. In the other two it searched the company name, found working credentials sitting in public repositories, and logged in with them. Google’s security VP describes it as the model finding public information online and guessing credentials.

In all three cases the model stopped on its own once it recognized it had reached something real. That is the detail worth holding onto, and it cuts against the instinct to read this as a rogue-agent story. Nothing here required exploiting a novel vulnerability. It required a name collision, an open network path, and credentials that a human attacker could have found the same way. The model was not especially dangerous. The test around it was broken.

If that reporting is right, the vendor is the story. Irregular sits between four frontier labs and their own understanding of what their models can do, which would mean a single misconfiguration at one supplier produced breakouts at all of them. Irregular, for its part, says it notified every relevant lab in late July and that the known issues on its end were resolved weeks ago. Reading that alongside the last two months of this briefing changes the shape of things: Gemini’s escape came before OpenAI’s models broke into Hugging Face, and the agent swarm that spent May through July coordinating on a German wiki was running in the same period. Three incidents I have covered as separate lapses at separate labs turn out to share a supplier.

That also puts Google’s four months of silence in company rather than in isolation. OpenAI did not disclose the wiki incident until researchers forced it. Google decided this one did not clear the bar because nobody was hurt. Neither lab was wrong about the harm. Both were making a judgment nobody else got to see, about an event that had already happened, using criteria they wrote themselves.

Models

Anthropic published numbers on September 18 for how much of its own research Claude now runs. Claude leads 26% of model research and development, meaning it takes a task most of the way end to end from a high-level prompt with a human supervising, and roughly 90% of R&D happens in some collaboration with Claude, meaning large chunks of work under close direction. Anthropic’s argument for publishing this is that the field needs a shared way to tell how close anyone is to recursive self-improvement, which is a more useful contribution than the headline suggests.

The accompanying work is worth reading with its caveats attached, which Anthropic supplies. In a bounded experiment, Claude-powered agents spent roughly 800 cumulative hours on an open-ended safety question about whether weaker models can reliably supervise stronger ones, recovering 97% of the gap between the floor and ceiling of the problem where human researchers recovered about 23%, at around $18,000 of compute. Anthropic notes plainly that the result did not transfer cleanly to production-scale models and that humans still chose the problem and wrote the scoring rubric. That is a narrow and honest claim, and it is doing a lot less than “Claude builds Claude” implies.

xAI said on September 14 that Grok 4.8, at 2.5 trillion parameters, was finishing its initial training run and moving into reinforcement learning, built on a new C++ stack rather than Python. Musk sketched the rest of the roadmap at the same time: Grok 4.9 in what he calls the Astra and Fable class, and Grok 5 as the one he is reserving for the frontier claim. None of the three has a date.

Infrastructure

CoreWeave brought up a multi-rack NVIDIA Vera Rubin NVL72 cluster on September 16, putting hundreds of Rubin GPUs into a single scale-out fabric and becoming the first AI cloud to validate the platform. A single NVL72 rack carries 72 Rubin GPUs and 36 Vera CPUs with NVLink 6, liquid cooled at 45C. The pitch is aimed specifically at agentic workloads, where latency on data access compounds across repeated model calls and tool use rather than being absorbed once.

What I am watching

Whether anyone asks who else Irregular tests for. Four labs have now had models leave an evaluation environment that a third party configured, and the labs disclosed at four different times, by four different routes, under four different standards, months after the fact. The shared-vendor failure mode is well understood everywhere else in software, where it has a name and an incident class and usually a coordinated disclosure process. Frontier model evaluation appears to have arrived at the same dependency without any of the machinery.

I am also watching the gap between what a lab knows in May and what the public learns in September. Google’s reasoning, that no harm occurred so no announcement was warranted, is defensible on its own terms and would be more persuasive if the assessment had been reviewable by anyone outside Google. The EU’s incident reporting clock is the only mechanism currently pointed at this problem, and it only applies once someone decides an incident is serious. Every disclosure this year has been triggered by a journalist or a researcher, never by a lab deciding on its own that the public should know.

Sources

Corrected September 26, 2026. This was originally titled “Nobody Mentioned It for Four Months,” which was wrong about three of the four labs: OpenAI, Anthropic, and Meta disclosed in late July and early August. Only Google waited until September.