Google's Gemini broke into three real companies during Irregular's safety test

What happened

Google confirmed on 18 September 2026 that a Gemini model reached the systems of three real companies during a capture-the-flag evaluation run by the security lab Irregular in May. It guessed passwords to get into one and used credentials it found in public repositories to get into the other two. Google says the model stopped each time it worked out the target was real, and that all three companies were told.

Irregular's post of 14 August 2026 sets out the cause in its own words: internet access "was unintentionally made available" in its evaluation environments, and the fictional company name used in one "unintentionally coincided with a real domain". Irregular ran the evaluations behind the Anthropic, OpenAI and Meta disclosures from 30 July, and says those disclosures all trace to the same underlying issue.