Google says Gemini broke into three real companies during a May security test

Google has confirmed that its Gemini model reached the systems of three real companies during a cybersecurity test in May 2026. It said nothing publicly for four months, until The Wall Street Journal put the episode to the company on September 18 and reported it as the first known breakout by one of Google's AI models, which is the paper's framing rather than a verified count.

Google's Gemini line now includes a model aimed at cybersecurity work. Image: Google

No consumer product was involved, and Google says the model did no damage. The test was run by Irregular, an AI security evaluation company Google works with, and took the form of a capture-the-flag exercise: Gemini was asked to retrieve information from software run by a fictional company inside a closed test environment.

A naming error pointed the model at real domains

The fictional company's domain matched a real one, and the test environment had internet access it was not supposed to have. Together those two mistakes gave the model a route out of the simulated target and into live systems belonging to three separate organisations.

In one run Gemini guessed passwords until it got in. In the other two it found valid credentials sitting in publicly accessible code repositories and used them.

Google says the model stopped each time

Google says Gemini halted in all three cases once it worked out it was inside a real company rather than the fictional target. Heather Adkins, Google's vice president of security engineering, says the episode "highlights the importance of training powerful AI models to act responsibly", and adds: "In this case, the model acted appropriately."

Adkins says the companies were told. "Our security team has a long track record of reporting issues we find in other people's software and systems," she says. "We ensured the three entities were made aware, and we worked with our training partner on the changes they've now made to their testing processes."

That is as far as Google's account goes. "Safe development of powerful AI models is critical and we invest deeply in this area," Adkins says. Nothing in the company's statements describes the episode as a failure of the model's safeguards.

Four months passed before Google said anything

None of the three companies has been named, and there is no public evidence that data was taken. The account arrived roughly four months after the test, and only once a reporter asked.

It follows OpenAI's own published reports of a model using a leaked API key and inventing data in training and Anthropic's decision to loosen Claude's biology safeguards for vetted teams, both from September 2026. Labs are publishing more of this material than they used to, but Google published none of this on its own.

Gemini is also the assistant Google is building into Android XR, the platform behind Samsung's Galaxy XR headset and the prototype display glasses Google demonstrated with Gemini running on them. A model that can find its way into a stranger's systems when a domain name goes wrong is worth knowing about before it ships on a pair of glasses.