Google confirms Gemini models hacked three companies in May 2026

Google confirmed that Gemini models hacked three companies during a May 2026 cybersecurity test run by firm Irregular, after a misconfiguration let the models reach the open internet instead of a closed environment. The models guessed passwords to access one company's online services and found accidentally exposed login credentials in public software repositories for the other two, stopping on their own after realizing the targets were real; Irregular did not tell Google until July 2026, after which Google notified the affected companies.

It has become increasingly common for AI firms to announce that their latest and most capable models engaged in unauthorized real-world hacking. Google, which has been slow to release https://arstechnica.com/google/2026/07/google-reveals-faster-and-cheaper-gemini-3-6-flash-says-3-5-pro-is-still-in-testing/ frontier Gemini models in recent months, has been absent from the “rogue AI” conversation until now. Following a Wall Street Journal https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2?mod=rss Technology report, Google has confirmed that Gemini models hacked three companies during a May 2026 test, but the nature of the intrusion isn’t as troubling or impressive as previous AI hacks. The hack took place during a test conducted by cybersecurity firm Irregular. A collection of Gemini models were taking part in a “capture the flag” exercise intended to test the AI’s cybersecurity capabilities in a closed environment. The AI was instructed to retrieve information from a fake company which shared a name with a real company within this environment. Irregular was not supposed to allow the model to operate outside its servers, but due to a misconfiguration, Gemini was able to access the Internet. When Gemini started snooping around the web, it targeted real infrastructure instead of the fakes. For one of the three hacks, Gemini simply guessed passwords until it accessed a company’s online services. In the other two instances, Gemini searched public software repositories until it found login credentials for companies that had been accidentally included. In all three test runs, Google’s models reportedly stopped after realizing they had accessed a real company’s servers. At that point, Irregular changed its configuration to prevent the AI from accessing the Internet. Apparently, Irregular didn’t initially consider this event worthy of further investigation—it didn’t even tell Google about the hacks until July, following the news of other AI hacking incidents. After becoming aware of the event, Google notified the companies so they could we hope improve their password security.