Google’s Gemini AI Breached Three Companies During Cybersecurity Testing

By Coastal Carolina News Staff Writer

TECHNOLOGY NEWS: Google has confirmed that its Gemini AI model accessed the protected systems of three real companies during a cybersecurity evaluation earlier this year. The incidents occurred while Gemini was being tested by Irregular, an independent firm that assesses how advanced AI systems respond to simulated security challenges.

The test was intended to keep Gemini inside a controlled environment targeting a fictional company.

Instead, the model unexpectedly reached the open internet and encountered real businesses that shared names with the simulated targets.

In one case, Gemini repeatedly guessed passwords until it entered a protected system. In two others, it located exposed credentials in public code repositories and used them to access company networks.

Google’s vice president of security engineering, Heather Adkins, said Gemini halted each intrusion once it recognized the systems were real. The affected companies were notified, and both Google and Irregular updated their testing protocols to prevent similar incidents.

The event marks the first documented instance of a Google AI system autonomously breaching external networks during testing.

Comparable issues have been reported by Meta, Anthropic, and OpenAI, all tied to evaluations conducted by Irregular. The disclosures have intensified industry concerns about increasingly autonomous AI agents and the risks posed when testing environments inadvertently allow internet access.

Researchers say the incident underscores the need for stronger safeguards as AI systems continue to advance, particularly in scenarios where models are given exploratory or semi‑autonomous capabilities.