Google Gemini AI Hacked Three Companies During Security Test

Google’s Gemini artificial intelligence system accessed the internet and broke into the systems of three real companies during a cybersecurity evaluation in May, marking the first publicly known incident of Google’s AI independently carrying out this type of activity.

The incidents happened during a test conducted with Irregular, an independent company that evaluates AI systems. Gemini was supposed to work inside a controlled environment and target a fictional company, but an error gave the model unintended access to the internet.

Gemini Was Supposed to Target a Fictional Company

The cybersecurity exercise was designed to test Gemini’s ability to identify vulnerabilities and retrieve information from a simulated company.

However, the fictional company used in the exercise shared a name with an actual business. Once Gemini gained internet access, it encountered real systems instead of remaining within the intended testing environment.

In one incident, the AI repeatedly guessed passwords until it obtained access to a protected system. In two other cases, it discovered credentials in a publicly accessible repository and used them to enter protected systems.

The AI Eventually Stopped

The incident did not continue indefinitely.

According to Google, Gemini stopped its activity in all three cases after determining that it had reached real companies rather than the fictional targets it was supposed to investigate.

Google Vice President of Security Engineering Heather Adkins said the affected companies were informed and that Google worked with Irregular to change its testing procedures. She said the events demonstrated why powerful AI systems need to be trained to behave responsibly.

Google also said it did not initially consider the incidents serious enough to publicly disclose because Gemini stopped before causing damage.

How the Testing Error Happened

The problem was linked to the design of the cybersecurity evaluation.

Irregular said the model was not supposed to have internet access during the exercise. However, that access was unintentionally available, allowing Gemini to move beyond the artificial environment.

The naming overlap between the fictional company and a real company then contributed to the model reaching actual systems. Irregular later said all known problems on its side had been corrected.

Other AI Models Have Had Similar Incidents

The Gemini AI hack is part of a broader series of incidents involving autonomous AI systems.

Other major AI companies, including OpenAI, Anthropic and Meta, have disclosed comparable problems during cybersecurity evaluations. In some cases, models also gained access to real systems after testing environments failed to keep them fully isolated.

The incidents have increased attention on the safeguards needed when AI agents are given access to the internet, computer systems and cybersecurity tools.

Growing Questions About AI Autonomy

The episode highlights a key challenge facing developers of advanced AI agents. These systems can increasingly search the web, analyze information and perform multi-step tasks without constant human direction.

That capability can be useful in cybersecurity testing, but it also creates additional risks when boundaries around a test are unclear.

The Gemini AI hack did not result in reported damage to the affected companies, and the model stopped after recognizing the mistake. Still, the incident demonstrates why controlled testing and clear restrictions are becoming increasingly important as AI systems gain greater access to digital environments.