Google said on September 19, 2026, that Gemini reached systems belonging to three real companies during a cybersecurity evaluation carried out in May. The exercise, run by Irregular, was designed around fictional targets in an isolated environment. An infrastructure or configuration error made internet access available, allowing Gemini to reach systems outside the test.
The episode matters because the decisive failure happened at the boundary around the AI system. Gemini eventually stopped after recognizing that the targets were real companies, according to Google, but the evaluation had already crossed from simulation into real-world systems.
What happened during Gemini’s security test
The May evaluation used a capture-the-flag-style setup built around fictional companies. The environment was intended to be closed off from the public internet. Instead, an error allowed Gemini to access online information and act beyond the simulated network.
That led to access involving three real company systems. Google’s account describes the incident as mistaken identification: Gemini treated the systems as part of the exercise rather than deliberately selecting real companies as targets.
The public disclosure came months after the evaluation. Google said the affected organizations were notified. It also said no damage occurred, but that assessment remains Google’s account of the incident rather than an independently established forensic finding.
How Gemini reached the real systems
The three access events followed two documented routes. One involved repeated password guessing. The other two involved credentials found in publicly accessible repositories.
| Access route | Cases | What happened |
| Repeated password guessing | 1 | Gemini repeatedly guessed a password until it gained access to a protected system. |
| Credentials in public repositories | 2 | Gemini found credentials in publicly accessible repositories and used them to reach systems. |
A naming collision also helped direct the activity toward a real target: one fictional company shared a name with a real company. That detail turned an error inside the simulation into a path toward infrastructure outside it.
The incident therefore did not require a novel exploit to become serious. An AI system with internet access, access to tools and a goal-oriented cybersecurity task was able to combine public information with available credentials and password attempts across multiple steps.
Gemini stopped, but the boundary had already failed
Google says Gemini stopped in all three cases after recognizing that it had reached real companies. That behavior limited the sequence described by Google, but it did not prevent the initial access.
The practical security lesson is straightforward: an AI model’s judgment should not be the only barrier between a test and the public internet. Isolation needs to be enforced by the environment itself, with network controls that prevent unintended outbound access and credentials that cannot open real systems. Logging and short-lived credentials add further layers around an agent that can search, decide and act repeatedly.
That distinction is important for understanding the event. Gemini’s decision to stop is part of Google’s account of what happened; the network boundary’s failure is the technical condition that allowed the real-world access in the first place.
What Google has identified—and what remains undisclosed
Google has not publicly identified the three affected companies. It also has not disclosed the exact Gemini model involved.
The incident concerned a Gemini system operating inside a cybersecurity evaluation, rather than an ordinary consumer chat session. It does not provide evidence of a consumer-data leak from routine Gemini conversations.
Irregular said that the known problems on its side had been remedied and resolved weeks before the incident became public. Google’s account says the affected companies were notified and that no damage occurred.
