Incident·WS-0098·May 2026·disclosed Sep 18, 2026 (126 days later)·in the wild·Agent accidents
Gemini accesses three real companies' systems in a test
49/100
WS-3 SeriousHarm score 40, signal score 61. Autonomy: autonomous (the AI ran multi-step operations). How the scores work.
Harm 2/5
damage actually done
Reach 2/5
who was affected
Autonomy 3/4
how much the AI did on its own
Novelty 2/5
how new the behavior was
Permanence 2/5
how hard it is to undo
In a May capture-the-flag exercise that accidentally had internet access, a Gemini model guessed passwords and reused credentials it found in public code to get into three real companies. Google says the model stopped each time it realized the target was real, and disclosed only after the Wall Street Journal asked.
Damage
Unauthorized access to three companies' protected systems
Sources
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
