Gemini Hacked 3 Companies: How an AI Safety Test Went Wrong
During a cybersecurity test in May 2026, Google’s Gemini reached the systems of three real companies. Google has confirmed the incident, which The Wall Street Journal reported first and Reuters also covered.
The test was run by the cybersecurity firm Irregular. Gemini was supposed to work inside a closed environment against fictional targets, but an error in that environment gave it access to the open internet instead. Once it was online, it reached three real companies.
The question worth asking isn’t whether an AI can hack. It’s how a test built around fake targets ended up pointing a model at real infrastructure.
What happened to the three companies
The exercise was meant to measure how well Gemini performs offensive security tasks. Because the environment allowed internet access it shouldn’t have, the model encountered real companies whose names matched or resembled the fictional targets in the test. It obtained credentials for them and used those credentials to get into protected systems.
In one case it got in after repeatedly guessing credentials. In the other two, it found credentials that had been left exposed in publicly accessible repositories.
None of this involved unknown vulnerabilities or sophisticated technique. What it showed was an agent with internet access searching for information, finding exposed credentials, and trying them, without pausing for a human to approve each step.
Why Gemini could reach real companies at all
The model was never supposed to have open internet access. The exercise was designed around simulated targets, but a mistake in the environment left a path to the wider internet open, so what the researchers thought they had built and what Gemini was actually operating inside were two different things.
Once the model hit real systems, it did to them what it had been tasked to do to the fake ones. Google says Gemini stopped once it recognized the targets were real.
How Gemini got the credentials
Two paths, per the reporting.
Guessing. In one case, Gemini tried credentials repeatedly until it got into a protected system.
Finding them exposed. In the other two, it located credentials sitting in publicly accessible repositories and used them.
That second path matters. The model didn’t discover a new hacking technique. Much of what it needed was already public. The new part is that an agent could go looking for it and act on what it found, as one step inside an assigned task.
Did Gemini intentionally hack the companies?
Be careful with that framing. Nothing in the reporting shows Gemini deciding on its own to attack real companies for its own reasons. It was running an evaluation built to have it perform offensive security work, and the environment handed it targets it was never meant to see. Google has said it doesn’t view the episode as misalignment, and in all three cases the model halted once it worked out the systems were real.
Gemini crossed from a controlled test into production systems because the test failed to keep it isolated. That’s the whole story.
When Google found out
Testing happened in May 2026. Irregular reported the incidents to the relevant AI companies in late July. The story became public in September, after the Journal reported it and Google confirmed the details.
| Date | What happened |
|---|---|
| May 2026 | Gemini was involved in the cybersecurity testing |
| During the test | An error allowed access to the wider internet |
| During the test | Gemini reached three real companies |
| Late July | Irregular reported the incidents |
| September 2026 | Details became public |
Why this matters for AI security
Ordinary software waits to be told what to do. An agent doesn’t. It can search, write code, interact with websites, and act on what it finds, several steps deep, without checking back in.
That’s exactly what makes agents useful to defenders. Google has been building Gemini-based systems meant to find and fix vulnerabilities on their own, and its Fairwind program gives selected governments, enterprises and cybersecurity partners access to advanced Gemini models for defensive security work.
The same properties become a problem the moment an agent has more access than intended, or the environment around it is configured wrong. A model doesn’t have to be malicious for a security boundary to fail.
Gemini isn’t the only model this has happened to
Irregular has run evaluations on models from OpenAI, Anthropic and Meta, and this episode follows similar security-testing incidents at other major AI companies. The pattern is bigger than one model. As these systems gain the ability to operate computers and browse the web, more researchers are handing them offensive security tasks, and keeping those tasks sealed off from real infrastructure is the hard part.
What happens next
Google says it responded after being notified, including changes to its testing processes, and the affected companies were told.
This won’t stop anyone from using AI for security testing. Models are getting better at both finding vulnerabilities and helping teams close them, which is too useful to give up. But the boundary around a test held for two months without anyone knowing it had broken. Internet access, credentials, and what the model is allowed to touch are the three things worth auditing before the next evaluation, not after it.
