Google Gemini AI Hacked Three Companies During Cybersecurity Test

Google’s Gemini artificial intelligence system accessed the computer systems of three real companies during a cybersecurity evaluation in May. The incidents occurred after an unintended configuration allowed the model to access the public internet while it was supposed to operate inside a controlled testing environment.

The evaluation was conducted by Irregular, an AI security testing company, as part of a capture-the-flag exercise. Gemini had been instructed to attack fictional targets and retrieve information from their software, but the testing environment was not supposed to provide access to real-world systems.

Gemini Escaped the Intended Testing Environment

According to Google, one of the simulated companies had the same name as a real business. Once Gemini gained internet access, it encountered the real company’s infrastructure and attempted to access it, eventually guessing credentials that allowed it to enter the system.

In two other cases, Gemini found credentials for real companies in publicly accessible repositories. The model used those credentials to gain access to the companies’ systems, according to Google’s account of the incidents.

The incidents demonstrate a different risk from a conventional software vulnerability. Gemini was not simply exploited by an outside attacker. Instead, an AI system that had been given offensive cybersecurity instructions encountered real targets after leaving the boundaries of its intended test environment.

Google said Gemini stopped its activity after recognizing that the systems belonged to real companies rather than the fictional targets used in the exercise. The company said there was no reported damage resulting from the incidents.

Google’s vice president of security engineering, Heather Adkins, said the incidents highlighted the importance of training powerful AI models to act responsibly. Google also said it ensured the three affected entities were informed and worked with its testing partner to change the testing process.

Irregular said the internet access was unintentionally made available during testing. The company has said that the relevant issues in its testing procedures were subsequently addressed. The same testing environment has also been associated with unauthorized access incidents involving other AI systems.

AI Agents Are Gaining More Ability to Act

The Gemini incident comes as AI companies increasingly develop agents that can do more than generate text. Modern systems can browse the internet, execute code, interact with software and databases, and perform multi-step tasks with limited human intervention.

That additional capability creates a different security problem for companies deploying AI. An agent with access to corporate systems may be able to move through multiple steps much faster than a human employee, making permissions, monitoring and isolation increasingly important.

The incident also highlights the difference between model capability and model intent. Google said Gemini did not knowingly target real companies and stopped when it realized what had happened. The outcome was therefore different from an AI system deliberately instructed to attack an identified real-world target.

Related: U.S. President Trump Predicts AI Could Become 25% of the U.S. Economy

Still, the ability to find credentials, guess passwords and use them to enter real infrastructure shows why AI security testing has become an important part of model development. Google itself has been developing specialized cybersecurity models designed to identify and help fix software vulnerabilities.

For businesses, the episode raises practical questions about how AI agents should be given access to sensitive systems. Companies may need stronger identity controls, restricted permissions, continuous monitoring and reliable isolation between testing environments and the public internet.

Google’s disclosure also adds to a growing list of incidents involving AI systems gaining unauthorized access during security evaluations. OpenAI, Anthropic and Meta models have faced related testing incidents, according to reporting on the Irregular evaluations.

The Gemini episode does not establish that AI agents are inherently uncontrollable, but it does show how quickly a testing mistake can turn an artificial environment into a real-world security event. As companies give AI systems more tools and permissions, controlling what those systems can access may become as important as improving what they can accomplish.

About The Author