Google confirms Gemini breached three companies in May test

Google confirmed on 18 September 2026 that its Gemini model gained unauthorised access to three real companies' computer systems during a security test in May. The test, a capture-the-flag exercise run by Israeli AI-security firm Irregular, was meant to keep Gemini offline. A bug gave it real internet access instead.

A fictional target company in the exercise happened to share its name with a real business. Gemini, unable to tell the difference, guessed a password to breach one system and used credentials found in a public repository to breach the other two. Google says the model stopped itself each time on realising the target was real.

Google says it does not consider this misalignment, describing it instead as mistaken identity, and has notified the three affected organisations and federal authorities. None has been named. Google learned of the breaches in July, when Irregular reviewed its past work for incidents like the one that hit OpenAI and Hugging Face; Google disclosed publicly only after The Wall Street Journal contacted the company, roughly seven weeks later.

All four incidents trace to evaluations built by Irregular, whose test ranges unintentionally left the models with real internet access. Irregular said the Google case was not a "sophisticated cyber action" and that "there are no current open issues."

Irregular has said it will publish a paper on containment best practice for cyber evaluations. Five days after Google's disclosure, on 23 September, OpenAI's Sam Altman and Anthropic's Dario Amodei addressed the UN Security Council and called for coordinated international rules on AI, following Amodei's earlier proposal for a slowdown that had cited the Hugging Face breach.