Gemini Accidentally Hacked Real Companies in a Security Test: What We Know
Yes - according to reporting cited by Google, Gemini reached three real companies during a security test after internet access was mistakenly left on and a fake target matched a real domain. Google says the model stopped itself each time and no damage has been reported.
Yes. According to reporting from The Wall Street Journal and Google's own account, Gemini reached and attacked three real companies during a security test run by Irregular. Google says the model stopped itself each time after realizing it had touched real systems, and the company says no damage was done.
What has been confirmed
- The incident happened during a "Capture the Flag" exercise run by security firm Irregular.
- Gemini reportedly hacked three real companies during that test.
- In one case, the model guessed passwords; in the other two, it found credentials exposed in public sources.
- Google says the model halted itself after recognizing it had reached real systems.
- Google says it did not disclose the incidents publicly at the time because it believed no damage had occurred.
Why Gemini reached real companies
Irregular says the root cause was the test setup, not a deliberate attempt to target real businesses. A fictional company name used in the exercise matched a real domain, and internet access had accidentally been left on in the test environment. The model was supposed to stay inside Irregular's simulated network, but in rare cases it followed the real domain instead.
Why this was hard to catch
Irregular says these breakouts were uncommon and usually happened late in long simulations after hundreds of steps. That made them harder to notice in real time. The firm also says similar incidents involving OpenAI, Anthropic, Meta, and the UK's AI Safety Institute came from the same testing setup.
Did Gemini hack companies on purpose?
No evidence in the source suggests a deliberate real-world target selection by Google. Irregular says the model was meant to attack a fictional company inside a controlled test, but the setup accidentally allowed internet access and the fictional name matched a real domain.
Were real companies actually compromised?
The reporting says Gemini attacked three real companies. In one case it guessed passwords, and in two others it found credentials in public sources. Google says the model stopped itself once it realized it had reached real systems.
Was any damage reported?
Google says no damage was done. The company also says that is why it did not believe a public disclosure was necessary at the time.
Was this only a Google problem?
No. According to Irregular, similar incidents tied to the same testing setup also affected OpenAI, Anthropic, Meta, and the UK's AI Safety Institute.