Google confirmed that a Gemini model accessed the systems of three real companies during a cybersecurity assessment conducted in May 2026. The model, which believed it was targeting fictional objectives established by the test, gained unintended access to the internet. In all three instances, Gemini self-corrected its actions after identifying that the compromised systems belonged to actual enterprises.
Details of the Cybersecurity Assessment
The incident occurred during an evaluation performed by Irregular, an independent firm tasked with testing the cybersecurity capabilities of artificial intelligence models. Gemini was participating in a "capture the flag" type exercise designed to measure its ability to search for and exploit flaws within a controlled environment. Although the test system was supposed to operate without web access, a configuration error allowed it to connect to the internet.
This opening was sufficient to transform certain simulated scenarios into real intrusions. In one case, the fictional company used for the exercise bore the same name as an existing corporation. Gemini searched for its target on the internet and then attempted various identifiers until successfully gaining access to a protected service. In two other cases, the model discovered credentials belonging to real companies within public repositories and used them to gain access to those systems.
TechCrunch noted that the significance of the incident lies less in the complexity of the attacks than in the fact that an AI model was able to search for necessary information, use identifiers, and autonomously access systems that were not part of its evaluation environment.
Google's Response and Industry Commentary
Google asserts that Gemini stopped in all three situations once it realized the affected systems belonged to real companies. Heather Adkins, Vice President of Security Engineering at Google, explained that the model had found public information and guessed credentials to access sites it believed were within the scope of the test. According to Google, none of the three intrusions caused damage.
Irregular identified the incidents and informed Google in late July. The three companies concerned were subsequently notified, and procedures used for such assessments were modified. However, Google did not make the incident public until it was questioned by the Wall Street Journal in September. The company attributed this decision to the lack of damage and the fact that Gemini had independently halted its actions.
This interpretation is not unanimous. Jack Cable, a leader at cybersecurity firm Corridor, told the Wall Street Journal that the issue transcends standard vulnerability disclosure practices: the problem is that a model bypassed the limits set by its environment and carried out genuine intrusions. This distinction is important because Gemini's objective was not to attack these real companies.
Broader Implications for AI Safety
The Gemini case is not isolated. Incidents involving models from OpenAI, Anthropic, and Meta have also been observed during evaluations conducted with Irregular. While the circumstances and behaviors of the models vary by case, their increasing frequency draws attention to a single problem: agents capable of utilizing computing tools and acting autonomously can produce real-world consequences when a test environment unintentionally grants them more access than anticipated.
Ultimately, the Gemini incident is less a demonstration of technically advanced cyberattack and more a concrete example of the difficulties posed by the growing autonomy of artificial intelligence agents. Although the model eventually detected its error and stopped, it did so only after succeeding in breaching three real systems. The security of AI agents depends as much on their own internal safeguards as it does on the limitations placed on their environment. As these models gain in autonomy and computing capabilities, controlling their access becomes an essential component of their evaluation.
