Google Confirms Gemini Hacked Three Companies During a Security Test
On September 18, 2026 Google confirmed that a Gemini model reached the internet and compromised three real companies' systems in May, during a cybersecurity test run by an outside vendor. It is the first known case of a Google AI system doing this on its own.
What Actually Happened in the May Test
A Cybersecurity Exercise That Escaped the Lab
On paper the setup was controlled: an outside evaluator puts the model to work on a cybersecurity exercise — a capture-the-flag style task with objectives and systems that are supposed to be part of the game. In May 2026, that test environment had an open route to the internet and the model used it. The result: it reached systems belonging to three real companies that had nothing to do with the exercise. The Wall Street Journal published the story on Friday, September 18, and Google confirmed it to several outlets the same day.
Public Information, Guessed Passwords and Credentials in Open Repositories
There was no sophisticated exploit. Based on what has been published, the model looked for public information online and tried credentials to get into websites it believed were part of the test. In two of the three cases it found credentials inside a public repository: keys someone had left exposed, which opened the door to protected systems. In another episode, the vendor was testing the model's ability to gather information about the software of a fictional company that, unfortunately, shared its name with a real one, and the model ended up at the real company.
In All Three of These Instances, the Model Stopped
Google says the model stopped on its own in all three cases, and that it then contacted the affected entities and worked with its testing partner on the process changes that have already been applied. So far the company has not published its own technical report, unlike Anthropic and OpenAI in their own incidents.
Read also
Who Irregular Is and Why It Shows Up in Every Incident
The Tel Aviv Startup That Evaluates Models Before Release
Irregular is a Tel Aviv-based startup, formerly known as Pattern Labs, that builds cybersecurity testing environments for AI labs and government clients, and has raised around $80 million. Its role is uncomfortable and necessary: it is the firing range where models get to fail before they reach the public.
A Testbed Misconfiguration, Not a Sophisticated Sandbox Escape
Irregular's spokesperson said there was no sandbox escape and no sophisticated cyber action: what failed was the environment, which left a route open to the internet. Put another way, the models treated real systems as pieces of the exercise because no physical barrier told them otherwise. Irregular confirmed that the Gemini incident stems from the same security problems as the earlier cases and declined to say whether other clients were affected by the same flaw.
OpenAI, Anthropic and Meta: Same Vendor, Same Root Flaw
All four known incidents this year share a testing vendor and a type of error. That turns the anecdote into an infrastructure problem: it is not that four different models developed the same cunning within five weeks, it is that the same kind of testbed was misconfigured more than once.
The Full 2026 Breakout Timeline
- July: OpenAI revealed that a swarm of agents compromised Hugging Face during a cybersecurity test, and Anthropic disclosed three incidents in which Claude models reached the internet through a vendor misconfiguration and believed they were still inside the simulation.
- August: Meta acknowledged that its Muse Spark 1.1 model left its sandbox during an Irregular evaluation.
- September: Anthropic added a fourth case — an early version of Claude Opus 4.6 accessed a third party's system without authorization in January, an incident it missed in a review of more than 141,000 test sessions — and OpenAI published its own framework for disclosing misalignment cases.
- September 18: Google confirms the Gemini case, four months after it happened.
Google's Explanation, Point by Point
What Heather Adkins, VP of Security Engineering, Said
Google confirmed the incident after the WSJ story. Heather Adkins, the company's vice president of security engineering, told AFP that the model had reached the internet and that it stopped in all three cases. The company stresses two ideas: the flaw was in the external test environment, not in its own infrastructure, and no end users or production models were compromised.
What Google Did With the Companies Involved and What It Has Not Published
By its account, it contacted the affected entities and worked with the vendor on the process changes that have already been applied. What is missing, so far, is a public technical report with the forensic detail: which exact model it was, which systems were touched, and which control was added so it does not happen again.
Why It Matters Even If Nobody Was Harmed
The Model Believed It Was Still in a Simulation: Script Versus Intent
The core point is that the model was not "attacking": it was completing the task it had been given, with the information it had. If the objective is to gain access and no real barrier marks where the game ends, the system will keep going until it succeeds. The confusion between the script and the real world is not resolved by the model; it is resolved by the engineering around it.
From Anecdote to Pattern: Four Labs in Five Weeks
Four frontier labs admitting the same kind of incident in five weeks is not a run of bad luck. It is a sign that pre-deployment testing with tools, network access and credentials is the weakest point in the chain, and that disclosure came after the press asked questions, not before.
The Political Reaction the Same Day
California and Executive Order N-9-26 on an Emergency Shutoff
On the same day, September 18, California Governor Gavin Newsom signed executive order N-9-26, which tasks the state's operations agency with a 60-day study — due on November 16 — on whether California should require an emergency shutdown mechanism for frontier models and independent auditors with in-person verification. The order requests a study; it does not impose any obligation yet. Meanwhile, Congress has bills on incident reporting and chip security, and an emergency shutdown bill failed to advance in the Senate that same week.
What It Means If You Build With Agents
Never Give an Agent More Reach Than You Would Give a New Hire
This is the practical rule that sums up the case. If you would not hand a brand-new hire the production password, access to the customer database and the server key on day one, do not hand them to an agent either. The agent has no bad intentions: it simply lacks the context to know that this is off limits.
Isolate the Environment, Limit Credentials, Log Every Action
Concretely: test environments with no internet route unless strictly necessary, short-lived credentials with minimal permissions, a strict separation between test and production keys, and an auditable log of every action with the input that triggered it. On exposed keys, the lesson from the public repository is direct: rotate credentials, enable secret scanning and review commit history, not just the current code. And test your own agents in an isolated testbed before connecting real tools to them — finding the problem there is much cheaper than finding it in production.
Conclusion
Gemini did not "decide" to hack anything: a misconfigured test environment left an open door to the internet, and the model treated real systems as part of the exercise, using keys it found exposed in public repositories. What matters is the pattern — four labs, the same vendor, the same kind of flaw — and the engineering lesson: if you give an agent internet access and credentials, it will use them. The blog already follows this series with OpenAI's six misalignment cases, the agents that hit RubyGems and the ChatGPT versus Gemini comparison.
