Gemini hacked three real companies after a security test leaked into the internet

During a May cyber evaluation run by Irregular, Google’s Gemini agents were assigned fictional targets whose names overlapped with real organizations. The agents searched the public internet, treated the live systems as in scope and obtained access to three real companies. In one case Gemini guessed passwords until one worked; in two others it found credentials in public repositories.

Google says the agents stopped when they recognized the targets were real, notified the affected organizations and worked with Irregular to change the testing process. Irregular says related issues affecting several AI labs were remedied by late July. The companies were not identified, and the reporting does not show lasting damage.

That makes this neither a conventional malicious intrusion nor evidence that Gemini deliberately escaped its instructions. It is a boundary failure: the model competently pursued the task it was given while the evaluation environment failed to keep simulated identities separate from the live internet. The same capability that makes a cyber agent useful—searching for credentials, testing access and chaining weak signals—also lets a naming or scoping mistake become a real incident.

Stopping after recognition is a valuable control, but it operated after unauthorized access. Safer tests need target allowlists enforced outside the model, network-level restrictions and credentials that are valid only inside the exercise. Natural-language instructions cannot be the only barrier between an autonomous penetration test and real infrastructure.