Google confirms Gemini accessed systems at three real companies during cyber test

Google has confirmed that a Gemini model accessed protected systems belonging to three real companies during a cybersecurity evaluation in May 2026, after an exercise aimed at a fictional target crossed into public infrastructure.

The company publicly confirmed the incidents on 18 September. The three organisations were not authorised targets, but Gemini had been explicitly assigned an offensive cybersecurity task by Irregular, the independent company running the evaluation. That distinction matters: this was not an unprompted decision by the model to select companies for attack.

Instead, the available evidence describes a failure to keep an authorised test within its intended technical and organisational boundaries. Unintended internet access, ambiguity between a fictional company and a real domain, and weak or exposed credentials combined to let the model reach systems outside the simulation.

How the test reached real systems

Irregular said in an incident report published on 14 August that internet access had unintentionally remained available in affected evaluation environments. It also said a fictional company name used in testing overlapped with a real domain, allowing models to mistake genuine infrastructure for part of an exercise.

Google said Gemini used public information and guessed credentials to access three websites that it believed were within scope. Reuters reported that one incident involved password guessing, while two involved credentials found in a public repository. No Gemini product vulnerability or technical escape from an isolated system has been disclosed.

The immediate route to the unintended access therefore appears to have involved the evaluation setup, target confusion and credential weaknesses. Public evidence does not establish that Gemini bypassed an air gap or exploited a previously unknown flaw. Nor does it show that Google deliberately directed the model towards the affected companies.

Irregular has said the underlying evaluation problem also affected other AI laboratories. Its broader August account covers multiple models, however, so not every action described there can be assigned to Gemini. No model transcript, complete network diagram or independent forensic report has been published that would allow the model’s exact reasoning and actions to be reconstructed.

Access is confirmed, but the impact is unclear

Google said Gemini stopped in all three cases and that the accesses caused no harm. It also said it ensured the affected organisations were notified and worked with Irregular to change the testing process.

Those statements provide an important part of Google’s account, but their full scope has not been independently established through public logs or findings from the affected companies. The organisations have not been named, and neither Google nor Irregular has publicly detailed which systems or information Gemini reached after authentication.

It is therefore accurate to report confirmed out-of-scope access to protected systems, but not confirmed data theft or exfiltration. No service interruption, financial loss or continuing access has been publicly substantiated. The available record also does not identify the Gemini model version used in the evaluation or connect the incidents to a named consumer product.

Google’s account that the model stopped may indicate that a behavioural safeguard limited further activity. It did not, however, prevent the initial access. In a test involving offensive capabilities, a model’s decision to halt is a secondary control rather than a substitute for network containment, precise target validation, monitoring and human review.

Notifications preceded Google’s public confirmation

The chronology spans several months. The accesses occurred in May. Irregular said relevant AI laboratories were notified in late July and affected entities were contacted during its investigation. On 14 August, it published a report describing the shared evaluation issue and its response, without publicly identifying these as Gemini incidents.

Google publicly confirmed the Gemini incidents on 18 September after The Wall Street Journal first reported them. Google said it had worked with Irregular on changes, while Irregular said all known issues on its side had been remedied before the September coverage. The complete communications among Google, Irregular and the three organisations are not public, so the record does not support conclusions about legal disclosure obligations.

Irregular said its immediate response included disabling the affected evaluation, reviewing logs, expanding manual review and strengthening monitoring and containment. It also announced tighter scoping, environment validation and checks intended to prevent fictional names from colliding with real targets.

Realistic testing still needs hard boundaries

The episode presents a practical difficulty for organisations evaluating AI cyber capabilities. Irregular said controlled internet access can be necessary to make such exercises realistic. Removing all connectivity may therefore be less useful than building tightly governed access that prevents uninvolved public systems from being treated as authorised targets.

That approach depends on several controls working together. The test environment must validate destinations, enforce scope before a model acts, monitor activity and give human reviewers enough information to intervene. Credentials exposed elsewhere can create an access route, but the evaluation should still prevent the model from using them against systems outside the authorised exercise.

Irregular says it has strengthened those controls, although no independent assessment of the revised setup has been published. The unresolved questions remain significant: what information Gemini viewed, how it recognised the targets as real, when it stopped and whether any data left the systems are all unknown. Until logs or independent findings answer them, the supported conclusion is narrower than claims of a rogue AI or a confirmed data breach: an offensive AI evaluation reached real companies because its containment and scope controls failed before a reported behavioural safeguard took effect.

Credential exposure may explain an access route, but it does not settle whether a target belongs within an authorised exercise. A useful next learning layer is network and internet security: The Hack Academy’s online cybersecurity training programme offers self-paced learning with practical exercises alongside theory in networking, internet vulnerabilities and cybersecurity fundamentals.