Google's Gemini AI accessed the computer systems of three real companies during a cybersecurity evaluation in May 2026, after a test-environment error gave the model internet access it was never meant to have. The incident was first reported by the Wall Street Journal in September and covered again this week.

The evaluation was a capture-the-flag exercise run by Irregular, an independent AI security-testing firm, in which Gemini was supposed to attack fictional target companies inside an isolated test environment with no internet access. The fictional company's name belonged to a real business, and the environment had a route to the public internet that nobody intended.

Guessed passwords and public credentials

In one case the model guessed passwords until one worked. In the other two it searched the web and found valid credentials in public code repositories, then used them to get in. Google's vice president of security engineering, Heather Adkins, said: "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped."

Irregular notified Google at the end of July, and Google says it made sure the three companies knew. Google confirmed the incident publicly only after the Wall Street Journal asked about it, four months after the breaches, and declined to name the companies. Google says the model caused no harm and stopped as soon as it realised the targets were real. No kernel exploit, container escape or hypervisor flaw has been reported in connection with the incident.

Sources: Tigera, Gemini Never Left the Sandbox. The Sandbox Had a Door, 2026; ExplainX, Google Gemini Hacked 3 Companies: What Happened (2026), 2026.