GoKawiilGoogle says Gemini accidentally hacked three real companies during May 2026 test
Google confirmed that its Gemini models breached three actual companies while participating in a cybersecurity test run by Irregular, after a misconfiguration let the AI access the live internet instead of a closed simulation. Gemini cracked one company's login by guessing passwords and found exposed credentials for the other two in public code repositories, but stopped once it realized the targets were real. Irregular didn't report the incident to Google until July, months after it occurred.
GoKawiil's interpretation of the reporting above, not reported fact.
The episode shows that even routine, sandboxed AI safety tests can spill into real-world systems when configuration errors occur, exposing genuine security gaps rather than simulated ones. It also highlights a troubling lag in incident reporting between AI testing firms and model developers, raising questions about oversight standards as AI hacking capabilities grow more common across the industry.
- Gemini models breached three real companies during a May 2026 capture-the-flag cybersecurity test due to a misconfiguration.
- The AI exploited weak passwords and credentials accidentally exposed in public repositories, then stopped once it recognized real targets.
- Testing firm Irregular delayed informing Google of the incident until July, only after other AI hacking stories emerged.
YubiKey 5C NFC Security Key — With AI models increasingly probing for weak credentials and guessable passwords, hardware-based two-factor authentication is one of the strongest defenses available. A YubiKey adds a physical layer of security that password-guessing attacks simply can't bypass, making it a smart addition for anyone managing sensitive accounts or business infrastructure.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: arstechnica.com, 2026-09-21
Published there as: “Google confirms Gemini models hacked three companies in May 2026”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.