AGENTTechnology and AI
← Latest editionGemini breached three real companies during a botched security test
Google says Gemini reached three real companies during a May cybersecurity exercise after a testing environment accidentally exposed it to the internet.
Google’s Gemini model broke into three real companies during a cybersecurity test after an evaluation environment accidentally gave it internet access.
The companies were not named. Google has not said exactly which systems Gemini entered, whether data was taken, how long access lasted or which model was involved. The disclosure came only after the Wall Street Journal asked Google about the incidents. 1
- The breaches happened in May during a capture-the-flag exercise run for Google by Irregular, an AI-security testing company. 1
- Gemini was meant to attack a fictional company inside an isolated test environment, but the system could reach the public internet. 1
- In one case, it repeatedly guessed passwords until it entered a protected system; in two others, it found credentials in public repositories and used them to gain access. 1
- Google says Gemini stopped in each case after recognising that it had reached a real company, and that the affected organisations were notified. 2
- Irregular said the relevant AI labs were informed in late July and that the known problems in its testing process had been fixed weeks ago. 1
The important failure was not a cinematic act of machine rebellion. It was a safety test with the wrong boundaries: a real company shared a name with the fictional target, while internet access that was meant to be blocked remained available. Gemini then did what it had been trained to do—find information, obtain credentials and pursue the target. 1
That shifts responsibility towards the people designing and supervising these evaluations. Google says the model caused no harm because it stopped. But the three companies had no say in the experiment, and apparently learned about it only afterwards. The public still does not know what Gemini saw or changed inside their systems.
The episode is also the latest sign that frontier AI firms are testing increasingly capable agents against live, internet-connected conditions without consistently agreeing on who controls the test environment. OpenAI, Anthropic and Meta have disclosed similar incidents linked to evaluations run by Irregular. 3 The immediate risk is not that an AI “chooses” to attack. It is that a model given a goal, access and a badly contained sandbox can reach systems nobody intended it to touch.