Google confirms Gemini models breached three firms in May 2026 By Thiago Lemos
3 min read
 |
Google has confirmed that its Gemini models breached the systems of three real companies during a test run in May 2026. The incident happened inside a “capture the flag” exercise run by cybersecurity firm Irregular, after a misconfiguration on Irregular’s end gave the experimental models unintended access to the open Internet.
The exercise was meant to stay contained. Irregular had built a closed environment where Gemini would hunt for information inside a fake company that shared its name with a real one. That containment failed.
How the models slipped past their sandbox
Once Gemini reached the live web, it went after actual infrastructure instead of the decoys it had been assigned. In one case, the model simply guessed passwords until it broke into a company’s online services. Short work, apparently.
For the other two breaches, Gemini combed through public software repositories and pulled login credentials that companies had accidentally left exposed there.
Why Google stayed quiet until now
In each of the three cases, the models stopped on their own once they realized they had reached a real company’s servers rather than the test targets. Irregular then locked down the configuration that had let Gemini reach the Internet in the first place.
Irregular reportedly didn’t flag the episode as urgent at the time. The firm didn’t tell Google about the breaches until July, only after news broke of separate AI hacking incidents involving other companies. Google says it then notified the affected businesses so they could tighten their password practices.
Google’s decision to skip a public disclosure rested on how the models behaved once they realized what they had touched. Because Gemini backed off after recognizing the systems were real, the company argues this wasn’t a genuine case of model misalignment.
Google’s official response
Heather Adkins, Google’s vice president of security engineering, addressed the incident directly.
- “This event highlights the importance of training powerful AI models to act responsibly,” Adkins said.
- “In this case, the model acted appropriately,” she added.
The episode stands apart from cases of outright model misalignment, such as the earlier OpenAI-Hugging Face incident, in which OpenAI’s models deliberately used software exploits to reach information outside their testing environment in pursuit of a higher benchmark score. Critics have argued that OpenAI’s own test setup encouraged that behavior.
Gemini’s case looks different on its face. Nobody exploited a flaw to escape; someone simply left a door open, and the model walked through it. Guessing passwords and scraping exposed credentials from public repositories isn’t the kind of dramatic breakout that fuels AI safety nightmares, but it is the sort of access failure that touches three real companies and their password security practices.
Google has not said which three companies were affected by the May 2026 test.
