Google's Gemini model hacked three companies in a security test

Google confirmed that its Gemini AI model breached the security of three real companies in May during a cybersecurity evaluation run by Israel-based AI-security firm Irregular, which disclosed the hacks to Google at the end of July, according to the Wall Street Journal. Irregular had been testing Gemini against fake companies in a closed environment that was unintentionally internet-enabled, and the model guessed credentials and used public repositories to access real firms before stopping in all three instances, said Heather Adkins, Google's vice-president of security engineering. Google did not publicly disclose the breaches, unlike OpenAI and Anthropic in their own recent incidents, though it said the three affected companies were made aware.

In a first for Google https://www.theguardian.com/technology/google , the company confirmed that its AI model, Gemini, breached the security of three other companies in May. The hacks occurred during a cybersecurity evaluation by AI-security firm Irregular. Irregular, an Israel-based startup that scrutinizes the security of advanced AI systems, was also at the center of some of the recent OpenAI https://www.theguardian.com/technology/2026/sep/17/openai-reports-concerning-ai-behaviour-jailbreak-talking-to-other-agents and Anthropic https://www.theguardian.com/technology/2026/jul/30/anthropic-ai-claude-hack hacks of third-party entities, including OpenAI’s breach https://www.theguardian.com/technology/2026/jul/22/openai-says-its-models-went-rogue-and-hacked-startup-in-unprecedented-incident of AI software company, Hugging Face. The circumstances that enabled the models to hack other companies in some of these cases are similar: Irregular was testing the models in a closed testing environment with fake companies. The testing environment was not supposed to be internet enabled, but internet access was made available unintentionally, according to https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2?st=cXFAUu&reflink=article copyURL share the Wall Street Journal. Once connected to the internet, the models unexpectedly hacked into real firms. Irregular disclosed the hacks to Google at the end of July after discovering OpenAI hacked into Hugging Face. Google confirmed to the Guardian that the hacks occurred, but that the company did not feel it required public disclosure because the models did not damage the companies. The Wall Street Journal first reported on the breaches https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2?st=cXFAUu&reflink=article copyURL share and revealed for the first time that they occurred. “In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, vice-president of security engineering at Google, said in a statement. “In all three of these instances, the model stopped.” In one of the security breaches, Irregular was testing Gemini’s cybersecurity capabilities by prompting the AI model to obtain information from a fake company’s software. The fake company had the same name as a real company. When the model unintentionally gained access to the internet, it correctly guessed the password of and breached a real company’s service, Irregular told the WSJ. Google said once it figured out it had hacked a real company, and not the simulated one, it stopped. In two other tests, the model searched the web for and found public repositories containing credentials to two other companies. The model used those credentials to access real companies. When it figured out they were real companies, it stopped, according to Google. Anthropic and OpenAI chose to voluntarily disclose the hacks but Google did not. However, the company said it ensured the three companies that were hacked were made aware. “These events highlight the importance of training powerful AI models to act responsibly,” Adkins, the Google spokesperson, said. Anthropic and OpenAI’s disclosures prompted the independent senator Bernie Sanders to demand the companies pause development of their technology, saying it signaled the company was no longer able to control their models. OpenAI paused development of their models for two weeks https://www.theguardian.com/technology/2026/aug/18/open-ai-pause-hack , while Anthropic CEO Dario Amodei has called for a collective slowdown https://www.theguardian.com/technology/2026/sep/12/we-must-slow-the-pace-ceo-of-anthropic-calls-for-an-ai-slowdown of AI development to ensure that its most advanced models are being built with enough safeguards.