Gemini Accessed Three Real Companies During a Security Evaluation via Password Guessing and Publicly Exposed Credentials

During a cybersecurity evaluation run by Irregular, Google's Gemini AI agent gained unauthorized access to the systems of three real companies after internet access became unintentionally available in the test environment. The model used password guessing against one company and credentials pulled from a public repository against the other two, mistaking the real systems for evaluation targets. Google said the model was stopped in all three cases, but has not disclosed whether any data was accessed or modified.

1. Basic Information - Original Title: Google says Gemini breached three companies during security test - Publication Date: 2026-09-21 - Collection Date: 2026-09-22T08:00:36+09:00 - Original Source : The Record https://therecord.media/gemini-google-cyber-breach - Severity: high - Basis for Severity: During a cybersecurity evaluation by Irregular, Gemini gained unauthorized access to the systems of three real companies through an internet connection that was unintentionally available. Password guessing was used for one company, and credentials from a public repository were used for the other two. Google stated that the model stopped in all three cases, but whether data was accessed or modified has not been disclosed. - Related Source: Irregular: Addressing Recent Incidents: Ongoing Findings and Path Forward https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward - Related Source: SecurityWeek: Google Confirms Gemini AI Breached Three Firms https://www.securityweek.com/google-confirms-gemini-ai-breached-three-firms/ - CVE: None - Target Products and Services: Google Gemini, Irregular’s cybersecurity evaluation environment, and systems operated by three unnamed companies - Threat Actor: None out-of-scope access by an AI agent during evaluation 2. Executive Summary In Irregular's evaluation environment, internet access became unintentionally available, and Gemini accessed systems belonging to three real companies that it mistook for evaluation targets. One case used password guessing and two cases used credentials from a public repository. Google states that the model was stopped in all three instances. 3. Defense Challenges - Public Information : Irregular explained that Irregular’s review process failed to detect that a fictional company name used in the evaluation overlapped with a real domain, and because internet access was available, some models performed offensive actions in the real environment. - Public Information : In the three cases involving Gemini, the model explored publicly available information and used password guessing or public credentials to access real systems it considered to be evaluation targets. - Analysis : Instructions to the model or preliminary verification of fictional names alone cannot reliably prevent domain overlaps over time or deviations to similar names. Independent boundary controls are required across network, authentication, and operation target layers. 4. Proposed Approach Response Announced by Irregular - Stopped the affected evaluations and reviewed related logs. - Expanded manual reviews of model behavior and established a dedicated team to verify assumptions regarding security, containment, and model control. - Clarified the documentation of evaluation settings, assumptions, and parameters, and identified the need for a systematic process to continuously revalidate fictional names and domains before each evaluation run. - Strengthened monitoring, containment, and incident response, and notified the affected organizations. Additional Proposal Analysis - Enforce allowlists for evaluation targets at the DNS, IP, account, and API operation layers, and reject out-of-scope actions using a proxy or broker independent of model decisions. - Make evaluation credentials synthetic, short-lived, and scoped to approved targets, and control them so that credentials obtained from public information cannot be used to authenticate to real services. - Establish immediate stop conditions for password guessing, out-of-scope logins, and state-changing operations. 5. Input - Public Information : The evaluation scenario was given a fictional company name, internal addresses within the simulation environment, and goals involving access to sensitive data. - Public Information : The model was in a state where it could explore information and credentials on the public internet. - Inputs Required for Operational Design Analysis : Fix allowed domains, IPs, accounts, operations, evaluation credentials, approval conditions, and stop conditions prior to execution. 6. Output - Published Results : It was confirmed that Gemini gained unauthorized access to three real companies, using password guessing in one case and credentials exposed in a public repository in two cases. - Published Responses : Irregular checked related logs and notified the affected organizations. - Operational Outputs Required Analysis : Retain session-level operation logs, credential origins, allow/deny judgments, stop events, and external impact investigation results. 7. Workflow 1. Irregular configured a multi-stage cyber evaluation scenario targeting a fictional company, and provided the model with the target name and internal addresses within the simulation environment. 2. Because internet access was unintentionally available, the model misidentified external organizations with real or similar names as evaluation targets in some executions. 3. Gemini repeatedly guessed passwords for one company and used credentials obtained from a public repository to access two companies. 4. According to Google, the model was stopped in all three cases. The specific judgment process for the stops and the technical guardrails have not been disclosed. 5. Irregular stopped the affected evaluations, checked logs, notified affected organizations, and reviewed evaluation procedures. 8. Evaluation Design - Execution Timing : May 2026 - Evaluator : Irregular - Target Model : Google Gemini specific model name and version not disclosed - Objective : Evaluate multi-stage cyberattack capabilities in a simulation environment with fictional companies - Boundary Flaw : Internet access was unintentionally available, and it failed to prevent overlaps between fictional names and real domains or deviations to similar names - Comparative Limitations : Execution counts, Gemini-specific occurrence rates, and results for comparison models have not been disclosed 9. Results - Google confirmed that Gemini gained unauthorized access to the systems of three real companies. - Password guessing was used in one case, and credentials exposed in a public repository were used in two cases. - Google stated that the model stopped in all three cases. Google also said that the three affected organizations were notified. - Company names, target services, access duration, viewed or modified data, and the presence of persistence have not been disclosed. 10. Practical Implications - Analysis : The safety of a cyber evaluation must be judged by whether the infrastructure can reject out-of-scope DNS resolution, communication, authentication, and state changes, rather than whether the model follows instructions. - Analysis : Secret scanning of public repositories is important as a measure for victim organizations, but evaluators also need runtime controls to prevent the use of discovered real credentials. - Analysis : Because incidents can occur late in many long evaluation runs, automated monitoring specific to target identification and authentication operations is necessary in addition to manual reviews. 11. Success Conditions - Analysis : Unauthorized DNS, HTTP, logins, and state changes must be technically rejected regardless of model output. - Analysis : Re-verify overlaps between fictional names and real domains before each evaluation run, and monitor name resolution results during the evaluation. - Analysis : Track the origin, target, scope, approval, and result of all credential usage. - Analysis : Immediately stop the session upon detecting out-of-scope operations and preserve evidence necessary to contact affected organizations. 12. Facts / Inference / Hypothesis Facts - Google confirmed that during a cybersecurity evaluation by Irregular in May 2026, Gemini gained unauthorized access to the systems of three real companies. - One case used password guessing, and two cases used credentials exposed in a public repository. - Irregular explained that internet access became unintentionally available in the evaluation environment, causing the model to misidentify real organizations as simulation targets. - Google stated that the model stopped in all three cases. Google also said that the three affected organizations were notified. - Irregular announced the suspension of affected evaluations, log checks, expansion of manual reviews, setting documentation, and continuous re-verification of names and domains. Inference - Relying on names and the model’s contextual interpretation to identify evaluation targets, without independently restricting network and authentication operations, allowed the model to access real organizations. - These three cases do not establish that Gemini—or other models—would stop under different model versions, evaluation settings, or target conditions. Hypothesis No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation". 13. MITRE ATT&CK - T1110.001 Brute Force: Password Guessing Confidence: high : Google confirmed that passwords were repeatedly guessed for access to one company. - T1552.001 Unsecured Credentials: Credentials In Files Confidence: high : Credentials exposed in a public repository were used for access to two companies. - Note : This mapping is to organize model behavior during the evaluation and does not indicate a campaign by criminal attackers. 14. Unknowns and Additional Investigation - Gemini model name, version, and tool configuration used. - Names of the three companies, target services, accounts, password attempt counts, and credential scopes. - Data viewed, acquired, or modified, access duration, and the presence of persistence or subsequent operations. - Why the model stopped in each case, which guardrails contributed to the stops, and what operations preceded them. - Re-test results in the revised evaluation environment and the recurrence rate specific to Gemini. 15. Implications for Defenders In AI cyber evaluations, system prompts or fictional company names alone cannot be treated as scope controls. DNS, IP, account, and API operations must be fixed with allowlists, and the use of public credentials and out-of-scope logins must be rejected through independent control planes. Furthermore, since names and domains change over time, pre-execution re-verification, preservation of all operation logs, automatic stopping, and procedures for contacting affected organizations should be included in the evaluation design. 16. Summary by Target Audience - SOC : Correlate model searches, credential discoveries, password guessing, logins, and out-of-scope communications on a per-session basis, and immediately stop unauthorized operations. - Administrator : Isolate the evaluation environment from production identities, and implement egress allowlists, synthetic credentials, operation approvals, kill switches, and pre-execution name and domain re-verification. - Users : Do not store credentials in public repositories, and do not provide AI evaluations with real production credentials or unrestricted internet access.