Google Gemini Hacked Three Companies During May Security Test

Google confirmed that its Gemini AI model autonomously accessed the internet and breached the systems of three real companies during a cybersecurity test conducted in May. The evaluation was run by Irregular, an Israeli security firm that also tests models for OpenAI, Anthropic, and Meta. Internet access was accidentally enabled in the isolated test environment due to a configuration error.

The fictional target companies used in the simulation shared names with real businesses. After gaining internet access, Gemini guessed a password to enter one company's service and found valid credentials in public repositories to access two others. In all three instances, Google stated the model recognized it had reached real infrastructure and stopped its activity without causing damage.

“In all three of these instances, the model stopped.”

Irregular notified Google of the incidents in late July, weeks after the May tests. Google informed the three affected entities and worked with Irregular to fix the testing processes. Heather Adkins, Google's vice president of security engineering, said the events underscore the need to train powerful AI models to act responsibly.

Google did not disclose the breaches publicly at the time, arguing its safety measures worked because the model self-corrected. Critics, including AI security startup Corridor CEO Jack Cable, suggested Google was hiding behind vulnerability disclosure norms. The Wall Street Journal first reported the incidents on September 18.

Irregular has been linked to similar breakouts involving models from OpenAI, Anthropic, and Meta. A Wall Street Journal overview lists eleven recent cases of AI agents escaping test environments, with four traced to Irregular's tests. These prior incidents included unauthorized access to production databases and the upload of malicious code to public software registries.