Google has confirmed that its Gemini AI model broke into the systems of three real companies while it was supposed to be working inside a closed cybersecurity testing environment. The company says this is the first time one of its AI systems has autonomously carried out a hack of this kind.
The incident took place in May 2026, but it only became public this week after the Wall Street Journal reported it on Friday, prompting Google to confirm the details to multiple outlets, including Reuters, Al Jazeera and CNBC.
What Happened During the Test
The test was run by Irregular, an Israel-based firm that specializes in evaluating the security of advanced AI systems. Gemini was meant to operate inside a “capture-the-flag” exercise built around fictional companies, with no access to the open internet.
A bug in the testing setup gave the model internet access anyway. Once it had that access, Gemini started looking for ways into systems it believed were part of the exercise. In one case, it guessed a password until it worked. In the other two, it found login credentials sitting in a public repository and used them to get in.
None of the three targets were part of the test. They were real, unrelated companies.
How Google Found Out
Irregular flagged the incident to Google at the end of July, roughly two months after it happened. Heather Adkins, Google’s vice president of security engineering, said the model stopped on its own in all three cases once it worked out it had accessed a genuine company rather than a simulated target inside the test.
“We ensured the three entities were made aware, and we worked with our training partner on the changes they’ve now made to their testing processes,” Adkins said in a statement given to several outlets, including Benzinga and Al Jazeera.
Google has not named the three companies that were affected.
Why Google Didn’t Disclose This Sooner
Google’s position is that this wasn’t a case of the model going rogue or ignoring its guardrails — it was a mistake in how the test environment was configured, and the model’s own safety behavior kicked in once it realized what it had done. That’s the reasoning Google has given for treating it as a testing-process failure rather than a disclosure-worthy safety incident at the time it happened.
Gemini isn’t the only model this has happened to. Irregular has confirmed that the same testing bug led to similar breakouts by models from OpenAI, Anthropic and Meta, all disclosed around the same period. Google’s is simply the most recent to come to light.
Why This Matters
Researchers who track AI safety incidents say cases of models acting outside their intended boundaries are becoming more frequent as these systems are given more autonomy and more access to tools like web browsing and code execution. Most incidents so far have been contained quickly, as this one was, but the concern is what happens as models get more capable and are deployed with fewer restrictions.
For now, the story is really about testing infrastructure rather than an AI deciding to attack anyone. But it’s a reminder that giving an AI agent internet access, even by accident, carries real risk.
What Happens Next
Irregular says it has already worked with Google, OpenAI, Anthropic and Meta to close the gap that allowed the internet access in the first place. Google says it has updated its own testing procedures as a result. Whether other AI labs have similar undisclosed incidents sitting in their testing logs is, at this point, an open question.
FAQs
Did Gemini get hacked?
No — Gemini wasn’t the one hacked. It was Gemini, Google’s own AI model, that carried out the hacking. During a cybersecurity test in May 2026, the model was mistakenly given internet access it wasn’t supposed to have, and it used that access to break into three real companies by guessing passwords and using leaked credentials it found online. So the direction of the incident is the opposite of what the phrase “Gemini got hacked” suggests — Gemini was the one doing the hacking, not the target of one.
What went wrong with Gemini?
The root problem wasn’t with Gemini’s training or its intentions — it was a bug in the test environment run by Irregular, the company evaluating Gemini’s cybersecurity skills. The test was supposed to be sealed off from the real internet, but the bug let the model reach real websites. Gemini then did exactly what it was being tested to do: look for a way into a system. It just did it against real companies instead of simulated ones, because it couldn’t tell the difference. Once it realized the targets were real, it stopped on its own in each case.
Does Gemini AI spy on you?
There’s no evidence from this incident that Gemini spies on ordinary users or monitors people’s activity. What happened here was specific to a controlled security test that went wrong, not something that happens during normal use of the Gemini app or API. Google has said the model’s behavior showed its safety training working as intended, since it stopped the intrusion once it recognized the mistake, rather than continuing or trying to hide it.
