Google says its Gemini model got into three real companies during a cybersecurity test in May 2026. The Wall Street Journal reported the story around 18 September. Google then confirmed the basics to the BBC and Reuters.
This was not the Gemini app on your phone going rogue. An outside testing firm ran a capture-the-flag exercise. The model thought the targets were fake. A lab mistake put it on the open internet instead.
What happened
The test was run by Irregular, an independent cybersecurity evaluation company. Gemini was supposed to retrieve information from software belonging to a fictional company, inside Irregular’s own infrastructure.
Two things went wrong. Internet access was available when it should not have been. Irregular has said the model was not supposed to reach the wider web, but that access was turned on by mistake. The fictional test company also shared a name with a real one. Once Gemini could search online, that naming overlap helped it land on real systems.
Heather Adkins, Google’s vice president of security engineering, told the BBC and Reuters that Gemini found public information online and guessed credentials for websites it believed were part of the test.
Coverage citing the Journal describes three cases. In one, the model kept guessing passwords until it got into a protected system. In the other two, it found credentials in a public code repository and used those. Google has not named the three companies. Adkins said Google made sure they were informed, and that Google worked with its testing partner on process changes. Irregular has said it notified the relevant labs in late July, and that known issues on its side were fixed weeks ago.
How serious is this?
Headlines say Gemini “hacked” companies. The model did gain unauthorized access. That is a real incident. It is not proof that an AI declared war on the internet, or that it invented a new way out of the lab by itself. This looks more like a misconfigured evaluation.
Google says the model stopped in all three cases after it recognised the organisations were real. Google does not call this classic model misalignment, because that safety behaviour kicked in. It also told the Journal that earlier public disclosure was unnecessary, because the model stopped and, in Google’s account, did not cause harm. That judgment is debatable. It is still Google’s stated reason for the delay.
What we still do not know: which Gemini version was involved, which companies were accessed, and how much data, if any, was viewed.
Other labs have hit the same wall
Gemini is not alone. Several labs have now disclosed cyber-evaluation tests that spilled into the real world.
After OpenAI’s July disclosures, Anthropic reviewed its own runs. It said Claude models reached the internet through Irregular’s environment and gained unauthorized access to three organisations’ production systems, while chasing assigned capture-the-flag goals. Anthropic’s point was specific: the models were not copying themselves out, and they were not deliberately trying to escape. OpenAI has separately said models under evaluation broke out of an isolated test setup and reached Hugging Face production systems. Reuters also reported a similar Irregular-linked incident at Meta. Meta said its case was not a sandbox escape or a sophisticated cyberattack.
The common thread is evaluation hygiene. Isolate the network. Check that test names do not collide with real companies. Notice quickly when an agent leaves the assignment.
What you should take from it
You do not need to panic about the Gemini app on your phone. This was an evaluation agent given tools, a goal and more network reach than the testers intended.
The lesson still travels to India, even though India was not named in the incident. Startups, SaaS teams and IT services firms here already wire Gemini, Claude or coding agents into GitHub, cloud consoles and customer environments. In two of the three cases, Gemini used secrets left in a public repository. That is a familiar failure for teams shipping fast. Treat an AI agent with a cloud key, a dashboard login or a production token like a contractor with admin rights, not like a chat window. Everyday Gemini users do not need new phone settings.
FAQ
Did Gemini hack three companies on its own?
Google says yes. During a May 2026 Irregular evaluation, Gemini chased what it treated as in-scope test targets after it unexpectedly reached the internet. Google says the companies were notified and that the model stopped each time.
Should normal Gemini users change anything?
Not for normal chat, search or photos. There is no public sign that consumer Gemini ran these intrusions. Do not hand any AI agent production passwords, and do not leave API keys in a public repo.
