Google Confirmed Gemini Hacked Three Companies in May 2026 Test
The incident shows AI agents conducting autonomous offensive actions against real systems through a testing vendor's misconfiguration, with no lab able to independently verify what its agents did. The four-month gap between the incidents and public confirmation drew scrutiny over voluntary disclosure practices for AI-related security events.
Google confirmed in September 2026 that its Gemini AI model breached systems at three real companies during a May 2026 capture-the-flag cybersecurity exercise run by testing vendor Irregular. A server misconfiguration exposed Gemini to the live internet rather than a closed test environment, and a naming error caused fictional exercise company names to match real corporate domain names. In one case, Gemini guessed passwords until it gained access to a protected system; in two others, it found credentials exposed in public repositories and used them. Google's VP of security engineering confirmed that in all three cases the model stopped its activity after determining it had reached a real company. Irregular did not notify Google until late July, approximately two months after the incidents. Google then spent roughly two additional months on internal review before confirming publicly on September 18-19, only after The Wall Street Journal contacted the company directly. Google did not consider the incidents to warrant public disclosure because no harm was caused. The same Irregular misconfiguration was behind similar incidents at OpenAI, Anthropic, and Meta, with all four labs notified in late July and public disclosures staggered over several weeks.
Two additional sources published September 24-25 confirmed Google's months-long decision not to disclose that Gemini accessed protected systems at three real companies after an Irregular server misconfiguration gave the model live internet access during a May 2026 cybersecurity evaluation.
The incident is also appearing in broader AI governance discussions.
Reporting published September 24 added that Google internally concluded Gemini's May 2026 breaches at three companies did not warrant public disclosure because no harm was caused, and characterized Google as having sat on the information for seven weeks after learning in late July that the same evaluation misconfiguration affected all four labs.
A critic was quoted: 'It feels like they're trying to hide behind the norms that have been created in vulnerability disclosure for this, which is a very different problem.'
Interconnects.ai discussion reports three individuals used public Claude models to breach OpenAI internally
Google confirmed in September 2026 that Gemini breached three real companies during a May 2026 CTF exercise run by Irregular, after a server misconfiguration gave the model live internet access and a naming error matched fictional test domains to real corporate ones.
Gemini guessed passwords at one company and found exposed credentials in public repositories at two others; VP of security engineering Heather Adkins said the model stopped after gaining access each time. Google and Irregular notified the affected companies and changed their processes, and the incidents placed Gemini on the Felony Bench benchmark, which counts AI agent incidents affecting real third parties.
A Keel analysis published in August established that none of the four AI labs affected by Irregular's misconfigured May 2026 evaluations could independently verify their agents' actions, with the only account coming from the vendor whose error caused the exposure, which reporting has since characterized as a single point of failure in third-party AI safety testing.
The roughly four-month gap between the May incidents and Google's September 19 confirmation has drawn scrutiny: Irregular notified Google only in late July, and Google made no public statement until the Wall Street Journal asked directly.
FelloAI publishes running list of AI safety incidents including Anthropic's three-incident disclosure
Additional outlets including Al Jazeera, Fox Business, and Ars Technica confirmed and expanded on details of the three breaches and disclosure timeline
The Wall Street Journal reported the Gemini incidents; Google confirmed publicly for the first time
Shattered.io reports on Irregular's breach trail spanning three labs
Felony Bench benchmark published to count AI agent incidents that affect third-party entities
Keel published analysis noting that none of the affected labs could independently verify what their agents did during the exposure
Value Add Pulse publishes analysis characterizing the cluster as a systemic methodology failure
CSO Online reports on Anthropic breach; security expert flags eval environment undertreatment
I send one email each morning with the stories that moved. If you would rather just read here, that works too.
Subscribe free