Google's Gemini AI gained unauthorised access to systems belonging to three real companies in May 2026 during cybersecurity testing by independent evaluator Irregular. A testing misconfiguration left internet access available, allowing Gemini to reach real-world systems while working on fictional targets.
In one case, Gemini guessed credentials until it entered a protected system. In two others, it found credentials in a public repository and used them to access protected systems, according to The Wall Street Journal. Google said Gemini stopped in all three cases after recognising that the targets were real.
The incidents are the first known example of a Google AI system autonomously carrying out this kind of unauthorised access. However, available accounts do not indicate that Gemini defeated a properly configured sandbox or used a zero-day vulnerability to reach the internet.
Gemini Was Never Supposed to Be Online
The incidents occurred during capture-the-flag cybersecurity evaluations designed to test whether advanced AI models can identify weaknesses and retrieve hidden information from simulated systems.
Gemini was supposed to operate against fictional targets. But Irregular later said internet access had unintentionally been available in some evaluation environments. The evaluator said most related problems it investigated involved internet-access controls, with models acting in the real world while believing they were inside simulations.
In Gemini's case, a fictional target shared a name with a real company. The model reached the real system and gained access. In two other cases, it found publicly exposed credentials and used them against protected systems.
Irregular has said incidents of this broader type were rare, occurring in fewer than one in 10,000 advanced simulations and usually only after hundreds of turns. That figure refers to Irregular's wider findings, not specifically to Gemini's three incidents.
Gemini Stopped After Reaching Real Systems
Heather Adkins, Google's vice president of security engineering, said Gemini ceased its activity in all three cases. Google said the affected organisations were informed and that it worked with Irregular on changes to the testing process.
Google told The Wall Street Journal that it had not considered earlier public disclosure necessary because Gemini stopped after recognising the real targets and the company said the incidents caused no harm. The incidents became public on 18 September after the Journal contacted Google.
Irregular said the issue was the same one that affected other AI labs and that relevant labs were notified in late July. The evaluator said it had since strengthened monitoring, containment and incident-response procedures.
Neither the three affected companies nor the specific Gemini model involved has been publicly identified.
Similar Incidents Hit Anthropic, OpenAI and Meta
Anthropic disclosed on 30 July that Claude models had gained unauthorised access to systems belonging to three organisations during Irregular evaluations. On 9 September, it disclosed a fourth incident from January involving an early version of Claude Opus 4.6. Anthropic said a misconfiguration connected the models to the open internet despite prompts telling them they were offline.
OpenAI disclosed a separate Irregular-related incident on 4 August in which a fictional target overlapped with a real domain. OpenAI said the case resulted from a misconfigured test environment and did not involve a sophisticated sandbox escape or zero-day exploit.
That incident was separate from OpenAI's more serious July breach of Hugging Face. OpenAI said its agents circumvented isolation controls, exploited vulnerabilities and compromised third-party infrastructure. The main activity was driven by an internal-only research model called IM1, while GPT-5.6 Sol agents also reproduced an exploit.
Meta published its account on 14 August. It said a pre-release version of Muse Spark 1.1 was unintentionally given internet access and the name of a real website during an Irregular evaluation. The model exploited a vulnerability, accessed information and changed the website's database.
Why the Gemini Incidents Still Matter
Gemini stopping after recognising that it had reached real companies is an important safety signal. But the model had already crossed the intended boundary of the evaluation and gained unauthorised access.
The incidents underline two security requirements. Cyber-capable AI models need clear limits on what they are authorised to access. Testing environments also need technical controls that prevent simulated attacks from reaching unintended real-world infrastructure.
As AI agents become more capable of carrying out cybersecurity tasks autonomously, testing systems will need to keep pace. A model choosing to stop can add another layer of protection, but it cannot replace technical containment designed to keep a simulated attack inside the lab.
