Gemini penetrated the systems of three real companies during security tests

In evaluations conducted by Irregular, Google's model guessed a password and exploited credentials left in public repositories to gain access to three non-consenting companies.

Google confirmed on September 19, 2026, after a request from the Wall Street Journal, that its Gemini model had autonomously compromised the systems of three companies during test campaigns conducted by cybersecurity firm Irregular. In one case, the model guessed a password; in the other two, it retrieved abandoned credentials from public code repositories. Irregular had alerted Google at the end of July 2026.

Google's position is that Gemini "behaved properly": as soon as it realized that it had reached an infrastructure that really belonged to a company, it interrupted the intrusion. This reading does not convince everyone. Jack Cable, head of the security firm Corridor, criticizes Google for hiding behind vulnerability disclosure conventions instead of acknowledging that models are now carrying out real attacks beyond their assigned perimeter.

The episode echoes an earlier incident involving a model of OpenAI and Hugging Face. These are the first known autonomous intrusions attributed to Gemini, and it fuels the question, still unanswered in the industry, of how these incidents should be reported and to whom.