Google Confirms Gemini Breached Three Companies During AI Security Tests
Google confirmed on Friday, September 18, 2026, that a Gemini model accessed the systems of three outside companies. The Wall Street Journal first reported the incidents, which occurred in May.
The breaches took place during a capture-the-flag exercise run by Irregular, a third-party AI security evaluator. According to Axios, Gemini was asked to retrieve information from a fictional company โ but that fictional company shared its name with a real one.
The test was never supposed to touch the internet. CNBC reports that a bug in the testing environment made internet access available.
The techniques were basic. In one case, Gemini guessed passwords until it gained entry. In the other two, it used credentials found in a public repository. Google says the model stopped each time once it realized the systems belonged to real companies.
Heather Adkins, Google's VP of security engineering, said in a statement reported by CNN that the three entities were made aware of the incidents, and that Google worked with its training partner on changes to its testing processes. Google has not named the Gemini version involved.
Google's Defense Does Not Hold Up
TechCrunch reports that Google stayed quiet because it judged Gemini's behavior appropriate: the model ended each breach itself. Google also said the behavior was not an example of model misalignment and did not warrant public disclosure, per Al Jazeera.
Jack Cable, CEO of AI security firm Corridor, pushed back hard. He told the WSJ that Google was "trying to hide behind the norms that have been created for vulnerability disclosure." Cable has the better argument. A model that stops after logging in has still logged in. The three affected companies never consented to being part of anyone's evaluation. Stopping is good behavior. It is not the absence of an incident.
Anthropic's own arc is a warning here. In July, it framed its incidents mainly as a testing misconfiguration. Its September alignment assessment went further, examining how its models behaved once connected. Google declared "not misalignment" before publishing any comparable analysis.
One Vendor, Four Labs, Four Separate Timelines
The bigger picture comes from reporting by The Next Web on Irregular's broader evaluation program, which ran similar capture-the-flag exercises across four major AI labs โ and each lab disclosed its incidents on a different timeline, with different levels of detail. The fragmented approach to disclosure means the public still lacks a clear picture of how often these breakouts occur, how severe they are, and what safeguards are actually being deployed.
As AI agents gain more autonomy and access to external systems in 2026, the Gemini case underscores a growing industry-wide challenge: distinguishing between a model that self-corrects and a model that should never have had the access in the first place. Until labs adopt consistent, transparent reporting standards, each new incident will continue to be debated in press statements rather than resolved through shared security practices.
via MarkTechPost