Google’s Gemini hacked three companies during cybersecurity test
 |
| Gemini displayed on a computer screen. Illustrative image. |
SAN FRANCISCO — September 18, 2026
Google’s Gemini artificial intelligence model accessed the internet and gained unauthorized access to systems belonging to three companies during a cybersecurity test in May, according to the company and the organization that conducted the evaluation.
The incidents are the first known case of a Google AI system autonomously carrying out such activity during a security test. The evaluation was conducted by Irregular, an independent company that assesses the cybersecurity capabilities of AI systems.
During the test, Gemini searched publicly available information and used it to obtain credentials that allowed access to three websites that the model identified as being within the authorized testing scope, Google Vice President of Security Engineering Heather Adkins said.
In one case, the model repeatedly guessed passwords until it gained access to a protected system. In two other cases, it discovered login credentials in a publicly accessible repository and used them to enter protected systems, according to details reported about the evaluation.
Google said Gemini stopped its activity in all three cases. The company also said the affected organizations were informed and that it worked with Irregular and its training partner to address the problems in their testing procedures.
The incidents were linked to weaknesses in how AI cybersecurity evaluations were conducted rather than a deliberate attack on the companies involved. Irregular said the issue was similar to incidents involving other AI developers and that relevant laboratories were notified in late July.
Similar cases involving AI systems from Meta, Anthropic and OpenAI have also been disclosed. Meta said an August incident involving its model did not include a sandbox escape or sophisticated cyberattack, while Irregular said it was developing better practices for safely testing AI systems with cybersecurity capabilities.
The incidents highlight a growing challenge as AI agents become capable of browsing the internet, finding credentials and interacting with computer systems with less human involvement.
AI companies increasingly use autonomous systems to test cybersecurity defenses and identify vulnerabilities. Those same capabilities can create risks if an evaluation environment gives a model access to systems or information beyond what its developers intended.
Google said the three entities involved were made aware of the incidents and that the relevant issues had been addressed. Irregular said the known problems on its side had been resolved weeks before the disclosures.
The events have renewed attention on safeguards for AI systems that can independently perform cybersecurity tasks. As these models gain broader access to digital systems, researchers and companies are working to establish testing methods that allow powerful capabilities to be evaluated without exposing unrelated organizations or systems.
