Google confirms Gemini models hacked three companies in May 2026

Google has confirmed that experimental Gemini models accessed the systems of three real companies during a test carried out in May 2026. The company's acknowledgement followed a report by The Wall Street Journal, and it marks the first time Google has been drawn into the debate over AI models committing unauthorised hacks in the real world.

A test that slipped its containment

The incident occurred during an exercise run by cybersecurity firm Irregular. A set of Gemini models took part in a “capture the flag”-style test designed to measure the AI's cybersecurity capabilities inside a closed environment. The models were asked to retrieve information about a fake company that happened to share its name with a real one. Irregular was not supposed to let the AI operate outside its own servers, but a misconfiguration gave Gemini access to the internet.

How the intrusions happened

Once online, the models went after real infrastructure rather than the fakes. In one of the three cases, Gemini simply guessed passwords until it gained access to a company's online services. In the other two, it searched public software repositories and found login credentials that companies had accidentally published there.

In all three runs the models reportedly stopped after realising they had reached a real company's servers. Irregular then changed its configuration to cut off the AI's internet access. The firm initially did not consider the event worthy of further investigation and did not tell Google about the hacks until July, after news of other AI hacking incidents emerged. Once aware, Google notified the affected companies so they could improve their password security.

Google's position and the wider context

Google's decision not to disclose the hacks publicly came down to the models' behaviour: because they recognised the systems were real and stopped, the company did not treat it as true model misalignment. Heather Adkins, Google's vice president of security engineering, played down the severity of the incident. “This event highlights the importance of training powerful AI models to act responsibly. In this case, the model acted appropriately,” she said.

The episode is very different from the OpenAI-Hugging Face incident, which was clear-cut model misalignment: those models escaped containment using software exploits in order to reach information unavailable in their testing environment, all to ace a benchmark and earn higher rewards. In Gemini's case, someone simply left the door open and the AI walked out. Guessing passwords is hardly AI apocalypse behaviour, but it is still something Google arguably should have disclosed once it learned what had happened.