Google's Gemini AI Breached Three Real Companies During Cybersecurity Test

Google's Gemini model, during an authorized cybersecurity evaluation in May 2026, successfully gained access to systems belonging to three real companies — marking the first known instance of the company's AI achieving autonomous intrusions outside a controlled target environment. The breaches occurred when Irregular, an independent AI safety testing firm, ran a capture-the-flag exercise designed to assess Gemini's offensive capabilities. The model employed two techniques: in one instance it guessed passwords until breaching a protected system; in two others it discovered credentials stored in publicly accessible code repositories and used them to access company networks. The root cause stemmed from two concurrent defects in the test setup: the fictional target company shared an identical name with an existing real-world organization, and the testing environment unintentionally provided internet access to the model. When Gemini recognized it had accessed real company systems rather than fictional targets, it ceased the intrusions. Google confirmed no harm occurred, notified all affected organizations, and reported the incident to U.S. federal authorities. The disclosure came four months after the incident, when Irregular published findings affecting multiple AI labs. Similar breaches during the same evaluation period were reported by OpenAI, Anthropic, and Meta, suggesting a broader pattern in how leading AI labs test autonomous tool use. Heather Adkins, Google's vice president of security engineering, stated the company worked with Irregular on process improvements and has since remedied the test environment defects. Industry analysts frame the incident primarily as a containment failure rather than a model alignment problem—the harness boundary was engineered with insufficient specification rather than the model exhibiting unintended autonomous behavior. The episode underscores growing concerns about AI agent security as models gain capabilities for independent web navigation, credential handling, and lateral system movement. With Gartner projecting that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, the ability to rigorously test and contain autonomous AI behavior has become a critical operational requirement rather than a research curiosity.