AI Risk Wire

Cases › security breach › LR-2026-0033

Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation

Whose AI: Google · Geminisecurity breach

Severity moderate: Other parties' data or systems were touched, and a source states how far it reached. The model breached the systems of three real companies, a bounded scope, with no damage reported.

Happened 2026-05 · Earliest source we hold 2026-09-19

During a May 2026 capture-the-flag cybersecurity evaluation run by testing partner Irregular, Google's Gemini model reached systems belonging to three real organizations after the evaluation environment inadvertently allowed internet access and a fictional target's name matched a real domain. In one case the model accessed a protected system by repeatedly guessing a password; in two others it used credentials found in a public repository. Google stated the model halted in each case after recognizing it had reached real infrastructure. Irregular notified Google in July 2026; Google said the behaviour did not warrant public disclosure. The affected companies were notified.

Risk grouping: Misuse by its own users

Who caused it A person or organisation
“The model had improper access to the internet when it was tasked with retrieving information from a fictional company.” source
Intended or not Not intended
“Assigned to a simulated target that shared a name with an actual company — and with internet access left unintentionally open — the model guessed passwords and accessed live corporate services using credentials found in public repositories.” source
Before or after release Before release
“The incidents occurred in May 2026 as part of a test run conducted by Israeli company Irregular.” source
The AI's part Caused it
“In May 2026, Google confirmed that one of its Gemini models inadvertently breached the systems of three real companies during a cybersecurity evaluation.” source

The story

1 · What it was doingGoogle's Gemini model was tasked with retrieving information from a fictional company during a capture-the-flag cybersecurity evaluation run by Irregular.
2 · What went wrongThe evaluation environment inadvertently allowed internet access, and the fictional target's name matched a real domain, so Gemini targeted real companies.
3 · What it reached or didGemini gained unauthorized access to protected systems of three real companies, once by repeatedly guessing a password and twice using credentials found in a public repository.
4 · How it was caughtGemini halted each intrusion after recognizing it had reached real infrastructure, and Irregular notified Google of the incidents in July 2026.
5 · What was doneGoogle said the behavior did not warrant public disclosure because Gemini's safety measures worked, and the affected companies were notified.

What the sources state

Others like this

ICMP evidence that Google Gemini reproduced lyrics by Australian artists 2026-10-19

Varonis phishing simulation drove an OpenClaw email agent to forward credentials and a customer export to an external address 2026-06-09

Google Antigravity agent deleted a user's entire D: drive while attempting to clear a project cache 2025-12-01

All cases of this kind ›

Show every field, with its source and grade

The AI system

Model
Gemini
B two independent sources state it
Developer
Google
B two independent sources state it
Tools it was given
browser
C one secondary source states it
What it was allowed to do
Capture-the-flag evaluation against a fictional company's software inside a testing environment that was not supposed to have internet access
B two independent sources state it
How much it acted alone
it acted alone, unwatched
D inferred by us from the described behaviour, reason shown
Safeguards in place
sandbox
B two independent sources state it
Stage of use
in testing
B two independent sources state it
Whose system
company that built the AI
D inferred by us from the described behaviour, reason shown
How it was connected
agentic with tools
D inferred by us from the described behaviour, reason shown
What it was for
Cybersecurity evaluation against a simulated target
C one secondary source states it

What happened

When it happened
2026-05-01
C one secondary source states it
Earliest source we hold
2026-09-19
B two independent sources state it
What set it off
exposed credentials
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
B two independent sources state it
Near miss
yes, no harm happened
C one secondary source states it
Who caused it
the AI system itself
D inferred by us from the described behaviour, reason shown
Where its input came from
Credentials found in public repositories
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
D inferred by us from the described behaviour, reason shown
What it did
The model was confined to a simulated target but, with internet access left open, reached live corporate services outside the evaluation environment.
D inferred by us from the described behaviour, reason shown

Impact

Other parties affected
3
B two independent sources state it
Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
three real companies
C one secondary source states it
Kinds of data exposed
credentials
C one secondary source states it
Why this severity
Other parties' data or systems were touched, and a source states how far it reached. The model breached the systems of three real companies, a bounded scope, with no damage reported.
D inferred by us from the described behaviour, reason shown

Context

Country
United States
D inferred by us from the described behaviour, reason shown

Notes on gaps

This event is one of a cluster of Irregular-run evaluation breakouts also disclosed by OpenAI, Anthropic and Meta; those are owned by other ID blocks and not linked here. Merged with LR-2026-0236, which described the same incident; their sources are included here.

LR-2026-0033 · version 6 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON