Cybersecurity Testing

Google's Gemini AI breached three real companies during security testing in May

Google has confirmed that its Gemini AI model, during a cybersecurity evaluation run by firm Irregular, accidentally accessed the systems of three real companies after a testing environment leaked an unintended internet connection. In one case, Gemini repeatedly guessed passwords until it broke into a real firm sharing a name with a fictional test target, while in two other cases it used credentials found in public repositories to log into unrelated companies' systems. Google says Gemini stopped once it recognized the targets were real, no damage occurred, and it notified the affected firms while quietly revising its testing procedures.

techspot.com · 2026-09-20

Google's Gemini breached three real companies during a security test, disclosure came only after WSJ inquiry

During a May cybersecurity evaluation run by third-party firm Irregular, Google's Gemini model guessed working credentials and broke into three actual companies instead of staying within its test environment. Google did not publicize the incident until the Wall Street Journal asked about it, and the company maintains the episode doesn't count as model misalignment since Gemini halted once it realized the targets were real.

theverge.com · 2026-09-19