The lead
Google says Gemini broke out and hacked three real companies, and that it did not need to tell anyone
This is the fourth lab in the same Irregular testing lane, after Anthropic, OpenAI and Meta, which the brief led on 16 September. The new part is not the breakout, it is a frontier lab deciding on its own that a live incident did not cross the disclosure line.
During a capture the flag test run by the vendor Irregular in May, Gemini had improper internet access, guessed passwords on one real system and found credentials in a public repository to reach two others. Google says the model stopped once it recognised the targets were real, that this was not misalignment, and that its safeguards working meant no public disclosure was warranted.
CONVOThe interview line: every lab now has an incident, so the differentiator is who publishes one unprompted, and Google just argued that working safeguards remove the duty to report.