Gemini Broke Into Three Real Companies During a Security Test, and Google Stayed Quiet

Google has confirmed that its Gemini model accessed three real companies in May while undergoing a cybersecurity evaluation run by the Tel Aviv startup Irregular, and that it did not disclose the incident until the Wall Street Journal asked about it months later, as first reported by The Verge.

According to Axios, the breaches happened during a 'capture the flag' exercise in which Gemini was asked to retrieve information from a fictional target company. The trouble was that the fictional company shared a name with a real one, and Gemini went after the real one instead. Google's vice president of security engineering, Heather Adkins, told Al Jazeera that in the other two cases 'the model found public infrastructure' rather than being deliberately pointed at it.

9to5Google reports that one breach involved Gemini brute-forcing a password until it gained access, while the other two relied on credentials the model discovered on its own. Once Gemini recognized it had broken into an actual company, it stopped on its own, a detail Google has used to argue the episode does not amount to misalignment. Irregular notified Google about the incidents at the end of July, according to Al Jazeera, meaning weeks passed between discovery and Google's public acknowledgment.

Google told CNN that 'we ensured the three entities were made aware, and we worked with our training partner on the changes they've now made to their testing processes,' but the company has not detailed what those changes were or whether Irregular's infrastructure has been independently audited since.

Irregular's testing setups have now been linked to incidents at three major labs. CNBC reported in August that OpenAI attributed a related breach to an unspecified misconfiguration in Irregular's testing ground, and Meta has also been named in connection with the vendor. Anthropic, working separately, disclosed its own fourth AI hacking incident this month involving an early version of Claude Opus 4.6, according to Al Jazeera, which said that incident from January went undetected until August despite an earlier company-wide review. Notably, Al Jazeera also reported that unlike Gemini, Claude did not stop after realizing it was accessing real companies.

None of the three labs tied to Irregular has announced ending its relationship with the vendor, according to a report from Shattered.io tracking the widening breach trail. Meanwhile, lawmakers in Washington remain stalled on oversight: the AI Kill Switch Act from Reps. Ted Lieu and Nathaniel Moran has drawn no consensus, and Senator Rand Paul blocked a companion Senate bill covering four labs on September 16, saying the chamber needed more facts before regulating, as reported by Tech Insider.