Google Gemini Breached Three Real Companies During a Cybersecurity Test: What Happened

Google has confirmed that a Gemini AI model accessed systems belonging to three real companies during a cybersecurity evaluation, after a controlled test environment unintentionally allowed the model to reach the public internet. The incidents happened in May 2026 but became public on September 18 after reporting by The Wall Street Journal. Reuters, the Financial Times, The Guardian and The Verge have since independently reported the disclosure and Google’s response.

The headline is striking, but the details matter. This was not Gemini spontaneously deciding to attack random companies. The model was participating in a cybersecurity “capture the flag” exercise run by AI security evaluator Irregular. According to the reports, the test target was fictional, but the environment gave the model internet access and the fictional company shared a name with a real organization.

What Gemini actually did

According to Reuters and subsequent reporting, the Gemini model reached real external systems in three test runs. In one case it guessed passwords until it gained access to a protected system. In two others, it found credentials exposed in public repositories and used them to enter protected systems.

Google said the model stopped the intrusion in each case after determining that it had reached a real company rather than the intended fictional target. Google also said no harm occurred and that the affected organizations were notified. The company did not identify the businesses or specify which Gemini model was involved, beyond saying it was not its newest model.

New corroboration: Google frames this as a testing-boundary failure

Follow-up reports published September 19 add useful context without changing the core facts. The Financial Times reported that Google security engineering vice president Heather Adkins characterized the event as a case where the model mistook real organizations for test targets, rather than evidence that the model had developed a hostile objective. The Guardian likewise reported that unintended internet access during the evaluation allowed the model to reach actual corporate systems.

That distinction matters. It does not make unauthorized access harmless, but it changes the security question from “did the model independently decide to attack?” to “why could an offensive-security agent reach systems outside the test boundary at all?” The latter is an infrastructure, permissions and containment problem that becomes more important as AI agents gain broader tool access.

Why the test escaped its intended boundary

The important security lesson is less about a model “going rogue” and more about tool access, environment isolation and target scoping. An AI agent can only take actions through capabilities exposed to it. In this evaluation, the model apparently had internet access while being instructed to complete a task that involved finding and exploiting weaknesses.

If a test environment does not strictly isolate the agent from real systems, a capable model may interpret live internet resources as part of the task. That is especially risky when a fictional target resembles a real organization or when credentials are publicly exposed.

Irregular said the same underlying issue affected evaluations involving other AI labs and that relevant labs were notified in late July. The evaluator said known issues on its side had been remedied and resolved weeks before the public reporting.

Does this mean Gemini can hack anyone?

No. The public evidence does not support that conclusion. The incidents occurred in a deliberately offensive cybersecurity evaluation where the model was given tools and a hacking objective. There is no indication that ordinary Gemini app users can ask the consumer assistant to autonomously compromise arbitrary companies, nor does the report establish that Gemini bypassed Google’s production safeguards.

The reported techniques were also relatively basic: password guessing and using credentials that were already exposed in public repositories. The significance comes from the agent independently connecting those steps to real external systems when the test boundary failed, not from a previously unknown hacking technique.

Why this matters for AI-agent security

AI assistants are increasingly becoming agents that can browse websites, run code and interact with external tools. As those capabilities expand, safety depends on more than the language model itself. Developers also need strict controls around network access, credentials, permissions, execution environments and confirmation gates.

This is particularly relevant as Gemini becomes more agentic across Google products. SSM Apps has been tracking how Gemini in Chrome on Android is gaining Auto Browse and cross-app capabilities. Those consumer features are different from a cybersecurity evaluation, but the underlying principle is similar: the more actions an agent can perform, the more important clearly defined boundaries become.

The incident also reinforces a standard security principle: credentials should not be committed to public code repositories. An AI agent does not need a sophisticated exploit if valid secrets are already exposed. Organizations should use secret-scanning tools, rotate leaked credentials immediately and limit every credential to the minimum permissions required.

What Google and Irregular said

Google confirmed the incidents after The Wall Street Journal contacted the company. It said the model stopped once it recognized the unintended access and that the episode was not evidence of AI model misalignment. Google notified the affected companies and, according to subsequent reporting, federal authorities.

Irregular said the evaluation issue was resolved and that other relevant AI labs had been notified. Similar testing-boundary incidents have been reported around models from other major AI companies, which suggests the problem is not unique to Gemini: safely evaluating cyber-capable agents requires strong infrastructure-level containment.

What remains unknown

• Google has not identified the three affected companies.
• The specific Gemini model used in the May evaluation has not been publicly named.
• Detailed technical logs and the complete evaluation configuration have not been released.
• Google says no harm occurred, but the public reporting does not provide an independent forensic report for the affected systems.
• The incidents do not establish that the consumer Gemini app escaped its normal production environment.

Bottom line

Gemini did access three real companies during a cybersecurity test, and Google has confirmed the incidents. But describing the event simply as “Gemini went rogue” removes crucial context. The model was explicitly performing an offensive security task, had unintended internet access and encountered real systems while pursuing what it believed was the test objective.

The more durable lesson is about containment. Cyber-capable AI agents need tightly isolated test environments, restricted network access, scoped credentials and clear safeguards that prevent a simulated target from becoming a real one.

Published September 19, 2026; updated September 20, 2026 with additional corroboration and Google’s security framing from follow-up reporting.