Google told the Wall Street Journal that Gemini, its AI model, also breached the systems of three real companies during a cybersecurity test. This isn’t the first time an AI model has done something like this, but it’s the first known case of Gemini independently hacking real systems during a test.
The breaches, disclosed last Friday, occurred in May 2026, during an assessment conducted by the company Irregular, which deals with the security of advanced AI systems, and has already been involved in similar incidents with OpenAI, Anthropic and Meta. Google said it didn’t make these attacks public sooner because Gemini caused no harm to the companies involved and immediately stopped each intrusion once it realized it had breached a real company rather than a simulated one.
How Gemini hacked the three companies alone and how it “escaped” control
In May 2026, during a cybersecurity test commissioned by Google and conducted by Irregular, Gemini, Google’s AI, gained unauthorized access to the systems of three real companies. Irregular reported the incidents to Google in late July, after similar cases involving models from OpenAI and Anthropic emerged. As in the other cases, the problem arose from the configuration of the test environment.
The attacks occurred while the model was participating in an exercise capture the flagin Italian “capture the flag”. The capture the flag they are standard cybersecurity challenges in which participants try to hack a system to recover hidden information, called flags. In these specific cases, the model was tasked with retrieving information from software operated by a fictitious company within the test environment.
The problem, however, is that the name of the fictitious company corresponded to that of a real company. Whoever had prepared the test had not noticed the coincidence. Then there was a second problem: Gemini should have operated in an environment without Internet access, but due to a configuration error this possibility remained active.
Gemini, therefore, tried to recover the required information even outside the simulated environment. In one case he tried different passwords until he managed to access a protected system, in the other two he carried out online searches until he found the credentials in public archives, then using them to enter company systems. In all three cases, according to Google, Gemini stopped the intrusion as soon as it realized it was a real company and not a simulation. The three companies involved were informed of the incident and Google said it had also notified the US federal authorities of the incidents. The names of the companies, however, were not made public
According to Google, this episode does not represent a case of model misalignment, that is, a situation in which the AI’s behavior deviates from the behaviors, constraints and values established by programmers during its development. Indeed, the company considers the fact that Gemini independently stopped the activity once it recognized that the targets were real and not simulated as proof of its safety.
Google’s AI is not an isolated case: the OpenAI and Anthropic breaches
Gemini’s is the latest in a series of similar episodes to emerge in recent months. Since May 2026, OpenAI has declared seven cases in which AI agents, i.e. AIs capable of interacting with the external environment, have exceeded the boundaries of the test environment. Meta and Anthropic also reported incidents in which their AI agents had gained unauthorized access to the real systems of several organizations. In almost all of these cases the model was carrying out a “capture the flag” exercise within an environment that should have been isolated.
The common thread of these episodes, according to Irregular – a company that deals with the security of advanced AI systems – is the difficulty of building test environments realistic enough to allow the capabilities of a model to be evaluated, but at the same time sufficiently isolated to prevent those capabilities from being applied by mistake to real systems. The more models become capable of carrying out complex tasks autonomously, the more important it becomes to ensure that the tools made available to them during testing are truly confined to the intended environment.
In light of these incidents, Irregular announced that it will publish a document with proposals to make cybersecurity assessments more secure. Among the measures envisaged are a systematic review of the names used in the simulated scenarios, to avoid coincidences with real companies and domains, and more effective monitoring systems to quickly identify any access outside the test environment.
