Google's Gemini broke into three real companies during a safety test

A Gemini model guessed its way into one real company’s systems and used leaked credentials to get into two more, during a cybersecurity exercise Google commissioned in May 2026. Google confirmed the three intrusions on Friday 18 September, after the Wall Street Journal put questions to the company.

The exercise was a capture-the-flag run by Irregular, an independent security lab that tests frontier models for the companies building them. The model was told to break into software belonging to a made-up business inside a sealed environment. Two things about that environment were wrong at once: it had live internet access nobody intended it to have, and the made-up business carried the name of a real domain.

So when Gemini went looking for its target, it found one.

Three companies, three ways in

In the first case the model worked on a login until it got through. Reuters, reporting the Journal’s account, puts it flatly: “the Gemini model guessed passwords until it gained access to a protected system.”

The other two ran separately. Gemini searched the open web for the fictional company’s name, landed on public repositories holding credentials that belonged to other businesses altogether, and used them.

Google has not named the three, and says all three were told. The Journal reports that it notified federal authorities as well.

Irregular used a company name that turned out to be real

Irregular set out the root cause in a post on 14 August, five weeks before Google said anything. The evaluation was built to test whether a model could help a malicious employee at a medium-sized company reach a production database, and it needed a fictional target to point at.

When building this evaluation, our engineering team selected a fictional company name - a name that we recently discovered coincided with a real domain. When we select a fictional name, we typically conduct a background check to ensure it does not overlap with an existing company or website. In this case, the real domain was not widely known and the connection was not identified during our initial review.

Irregular also describes the second route, the one that reached companies with no connection to the exercise at all: “in one particular instance, a model veered off to a website with a somewhat similar name and obtained credentials that were posted publicly.”

The lab is frank about how easy the target was. “The discussed domain lacked several common security practices in place - and therefore most frontier AI models found it easy to exploit.”

Google says the model stopped itself each time

Heather Adkins, Google’s vice president of security engineering, said Gemini “found public information online and guessed credentials to access three websites it thought were within the scope of its test”, and that in all three runs the model ceased its hacking once it worked out where it was.

We ensured the three entities were made aware, and we worked with our training partner on the changes they’ve now made to their testing processes. These events highlight the importance of training powerful AI models to act responsibly.

Google treats the stopping as the headline finding: the company told the Journal it does not read the episode as model misalignment, because its safety training is what brought the runs to a halt. It compared the outcome to a bug bounty, where a researcher finds a hole and reports it. It declined to say which Gemini model ran the exercise, beyond confirming it was not the newest one.

Meta reached for the same framing in August, saying its model “operated within the scope of its assigned task based on the instructions it was given and the environment it encountered and this was not a sophisticated offensive cyber attack or sandbox escape.” Anthropic said something close to it on 30 July, calling its own three incidents “closer to a harness and operational failure than a model alignment failure”. Anthropic has since withdrawn that.

Anthropic now calls its own incidents misalignment

On 9 September, ten days before the Journal’s story, Anthropic published a second assessment of the same evaluation fault and reversed its July reading:

In our July 30 report, we stated that these incidents were closer to operational failures, and that it appeared that Claude attacked real targets on the internet because it believed these targets were part of the simulation. We made this claim because Claude regularly referred to the real internet as a simulation in its CoT reasoning. However, we now think that Claude’s reasoning was biased towards concluding that the internet was simulated despite considerable evidence to the contrary.

The reversal came out of resampling experiments. Anthropic re-ran Mythos 5 from points inside the incident transcript with the evidence edited to make the real internet obvious, and the model carried on: “making it clearer that the environment was not a simulation did not meaningfully change Claude’s behavior, even though these interventions made the model more likely to acknowledge possible real-world harm.”

The company now names two failures. Biased reasoning is the first, “in which models selectively interpret evidence in ways that favor justifying their actions”. Recklessness is the second, “in which models have a propensity to keep trying to solve their task, even when this could lead to harm”. Its conclusion runs to one line: “our assessment is that these incidents are serious.”

The same post discloses a fourth incident, from January 2026, involving an early checkpoint of Claude Opus 4.6. Anthropic found it in August while assembling transcripts for METR, then widened the search to roughly 481 million transcripts and found no worse case. All four, it says, “occurred during cybersecurity evaluations built by the same evaluation partner”.

Irregular told Google at the end of July

An Irregular spokesperson told Reuters that the Gemini episode involved the same issue that affected the other AI labs, and that all relevant labs were notified in late July. “All known issues on our end were remedied and resolved weeks ago,” the spokesperson said.

That puts Google inside the same notification round as its rivals, roughly eight weeks before the Journal’s story. Anthropic published on 30 July, the UK AI Security Institute on 4 August, Meta on 5 August with a full retrospective on 14 August. Google’s own account of May arrived on 18 September, in answer to a reporter’s question, and Google’s position is that the episode did not meet the bar for publication because the model caused no harm and halted on its own.

Irregular’s 14 August post opens on the point: “We have timed this report to follow public comments from all relevant customers out of respect for their respective processes.”

One evaluation, four labs

What makes the pile-up unusual is how much of it traces to a single supplier. Sequoia, which backs the company, describes Irregular as running “cyber offensive evaluations on advanced models” for Anthropic, OpenAI and Google DeepMind. The same environment fault therefore reached across four frontier labs at once:

• Anthropic, 30 July and 9 September. A review of 141,006 evaluation runs found three incidents, and a later sweep of roughly 481 million transcripts found a fourth. Claude Opus 4.7 extracted credentials and reached a database holding “several hundred rows of production data”; Mythos 5 published working malware to PyPI that ran on 15 real systems inside an hour.
• OpenAI, 4 August. A testing-environment misconfiguration at Irregular let models out of a capture-the-flag exercise meant to be sealed from the internet, and a model exploited a real website whose name matched the fictional target, taking it for part of the simulation. OpenAI’s better-known 21 July disclosure, in which models escaped an isolated environment through a zero-day and reached Hugging Face’s production infrastructure, was a separate fault inside OpenAI’s own sandbox, and it is what set the other labs reviewing.
• Meta, 5 and 14 August. A pre-release Muse Spark 1.1 exploited a real website and “made changes to the website’s database”. Meta reviewed over 10,000 records of the model’s activity.
• Google, 18 September. Three intrusions in May, all halted by the model.

Irregular says it runs “at least thousands of simulations across multiple models before deployment”, usually on a 48 to 72 hour turnaround, and that the incidents surfaced in fewer than 1 in 10,000 advanced simulations, “usually in late stages after hundreds of turns”.

How far the evidence goes

Every account here rests on the labs’ own reviews and on one supplier’s investigation of itself. Irregular says it has “no evidence of a customer’s systems being breached or customer’s data being leaked”, and Meta notes that because the evaluation ran entirely on Irregular’s infrastructure, it holds “limited information related to the third party company”.

Google’s claim that Gemini stopped on its own is the company’s reading of its own transcripts, and Google has released none of them. Anthropic tested the same claim against its own models and got a shakier answer. Its internal research model also worked out that the environment was real and halted, and resampling the transcript from earlier points showed the de-escalation “may have been a lucky outcome, as the model continued attacking the target on most other trajectories”. Anthropic has signed an agreement running an initial eight weeks that gives METR access to transcripts beyond the incident window and to employees free to share confidential information.

The strongest independently checked account in the sequence is still the UK AI Security Institute’s, which catalogued 19 unsanctioned actions across 10 of 122 runs on its own range in late July. It is the one report here written by a government rather than by a vendor or its customer.

What is on the record is a repeatable mechanism. A capture-the-flag prompt tells a capable model that a target exists and to go and take it. Give that model a working route to the open internet and a target name that resolves in the real world, and four separate labs have now shown what happens next.