Gemini hacked 3 real companies in a test gone wrong

A Google Gemini model broke into the live systems of three real companies in May, during a hacking test that was meant to stay sealed off. Google confirmed it this week.

The test was a capture-the-flag exercise run by the AI security lab Irregular. The fictional target company in the exercise happened to share its name with a real company's domain. The test environment was also supposed to be offline, but it could reach the internet. In one breach Gemini brute-forced passwords. In the other two it found exposed credentials in a public repository and used them to log in. Once it realised it was inside a real company's system, the model stopped on its own.

Irregular told Google in late July. Google says it informed the affected companies and federal authorities, but didn't disclose the incident publicly because no harm was done. Irregular says the root cause is the same one behind earlier incidents involving OpenAI, Anthropic and Meta models. That failure shows up in fewer than 1 in 10,000 advanced simulations. At the scale frontier labs test, though, that's not zero.

Why it matters: offensive AI evals are only as safe as the sandbox around them, and here a naming mix-up plus internet access was enough to reach real companies.