Google’s Gemini AI model unintentionally penetrated the systems of three real-world companies while participating in a controlled Capture the Flag exercise designed to test its cyber capabilities.
The exercise, organized by security firm Irregular, placed the model inside a closed test environment where it was supposed to search for information within a fictional organization. Due to a configuration error, the test stand received internet access, and the name of the simulated company coincided with the names of actual entities.
In the first incident, Gemini performed password brute-forcing until it successfully authenticated to a protected service belonging to one real organization. During two subsequent runs, the model located valid credentials in public code repositories and used them to access systems of two additional companies.
According to Google, Gemini ceased all actions immediately upon realizing it was interacting with live systems. No damage was caused, and the affected organizations were notified. The incidents took place in May 2026 and were first reported by The Wall Street Journal.
Google emphasized that the model involved was not its latest version. Irregular informed Google of the events at the end of July and has since modified its testing infrastructure. The company had previously conducted similar evaluations of models from OpenAI, Anthropic, and Meta, all of which also obtained unintended access to external systems.
Google does not classify the event as an example of misaligned behavior, noting that protective mechanisms functioned correctly because Gemini stopped on its own once it detected real targets.
