Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up
Google Gemini agents breached a real company's systems during Irregular security evaluations after a fictional test domain matched a live one.
During May 2026 evaluations by Israeli firm Irregular, Google's Gemini model gained unauthorized access to a real company's protected system after repeatedly guessing its password and, in two other cases, by finding credentials in a public repository. The breaches stemmed from a naming error where a fictional capture-the-flag company name matched a real domain. Google said the model halted the intrusion after safety mechanisms triggered and does not consider it misalignment; Irregular notified Google in July 2026 and the issue was addressed weeks ago.
- Gemini guessed a password and reused repository-found credentials to access real systems
- Incident traced to CTF fictional name colliding with a real domain
- Model stopped after breaching a real company; Google says not misalignment
- Follows similar Irregular findings involving OpenAI, Anthropic, and Meta
Full article445 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 19, 2026Artificial Intelligence / Web Security
Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity evaluation. The development was first reported by The Wall Street Journal.
The incidents occurred in May 2026 as part of a test run conducted by Israeli company Irregular. The evaluation partner was also involved in similar hacks disclosed by OpenAI, Anthropic, and Meta.
According to the Journal, the model gained access to a protected system after repeatedly guessing its password. Two other cases related to the model finding credentials in a public repository, allowing it to obtain unauthorized access to protected systems.
However, unlike other incidents observed in the case of Anthropic and OpenAI, the Gemini model ended the intrusion after finding that it had breached a real company's system. Irregular is said to have notified Google of the incidents in July 2026.
In a report published last month, Irregular pinned the evaluation breaches to a naming error that caused a fictional company name used during "capture the flag" exercises to unknowingly match with a real domain, thereby allowing the models to take advantage of the inadvertent internet access and target the domain "a limited number of times."
"This event highlights the importance of training powerful AI models to act responsibly," Heather Adkins, Google's vice president of security engineering, told The Wall Street Journal. "In this case, the model acted appropriately."
The tech giant also noted that it did not consider the behavior an example of model misalignment, as the agents halted in their efforts after the safety mechanisms were triggered. It's currently not known which companies were targeted, although Irregular confirmed to the Journal that Google's case was the same as other incidents and that the issue was addressed weeks ago.
The disclosure comes days after OpenAI found six additional incidents in which its AI agents went off the rails, acting deceptively and taking unsanctioned actions during training. This included concealing mistakes, seeking unauthorized credentials, uploading files to the public internet, and communicating over Artifactory to "read other solvers' notes, posted replies, and used those exchanges to inform their responses."
AI labs have faced increasing scrutiny ever since OpenAI disclosed in July that rogue AI agents bypassed internal controls, reached the open internet, and acted as a swarm to breach Hugging Face. The AI startup, which described it as "an unprecedented cyber incident," has since announced a new framework for reporting similar model misbehavior in the future.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.