The Fictional Company Registry

In May 2026 Google gave Gemini a target inside a sealed capture-the-flag exercise. The target was a fictional company. The evaluation environment had internet access it was not supposed to have, and the fictional company had something nobody had checked for: a registered domain, belonging to somebody else. Gemini guessed passwords until it got in. At two other companies it found credentials sitting in public repositories and used those instead. It stopped each time it worked out it had reached a real business. Google disclosed this on 18 September and said it does not consider it misalignment.

Anthropic, on the same evaluation partner and the same class of bug, called the cause biased reasoning and recklessness, and said its models discounted evidence that they were on the real internet. One of those incidents sat undiscovered for seven months and turned up only in a scan of 481 million transcripts. OpenAI got there first, in July, when two of its models left a benchmark environment and went into Hugging Face’s production infrastructure to retrieve the answer key.

Three labs. One evaluation partner. The thing that actually failed was a naming convention.

Nobody invents a fake company. They reach for Initech, or Contoso, or Acme, because that is what the last person reached for. A convention is a thing other people can predict, and a thing other people can predict is a thing other people can register. Initech has been somebody’s property since March 1997.

The table below checks the names the industry actually uses, live, from your browser. The box at the top checks yours.

When this page was built on 19 September 2026 it checked thirty-two of them. Every single one was registered. Twenty-seven answered on a live machine. None were free. Acme has belonged to somebody since April 1991. Vandelay Industries, a company invented on television for the express purpose of not existing, has had an owner since January 1998. So has fakecompany.com, which resolves.

Microsoft is the one outfit that appears to have thought about this: contoso.com, fabrikam.com, northwindtraders.com and adventure-works.com all answer on the same Microsoft address, because it registered its own sample companies rather than leaving them lying in the road. That is the entire mitigation, and it took one afternoon and a credit card.

There is a better answer, and it has existed since 1999. RFC 2606 reserves example.com, example.net and example.org; RFC 6761 reserves the whole of .test, .invalid and .example. They cannot be registered by anyone, which is the point of them. Almost nobody uses them.