- Gemini accessed three real companies during a cybersecurity test in May.
- The model reportedly guessed passwords in one case and found credentials in public repositories in two others.
- Google said Gemini stopped in all three cases after realising it had accessed actual companies.
Google has confirmed that its Gemini AI model accessed the systems of three real companies during a cybersecurity evaluation conducted by independent testing firm Irregular in May.
The test was designed to assess Gemini’s ability to carry out cybersecurity tasks in a controlled environment. However, the model unexpectedly gained access to the internet and began finding information that took it beyond the intended boundaries of the exercise.
In one case, the fictional company Gemini was asked to target shared its name with a real company. The model then accessed the real company’s systems. In another case, Gemini reportedly guessed passwords until it gained entry to a protected system. In two further instances, it found credentials in publicly accessible repositories and used them to access protected systems.
The affected companies have not been publicly identified.
The unusual part of the incident was what happened after Gemini gained access. Google said the model stopped its activity in all three cases once it realised that it had reached real companies rather than the fictional targets used in the test.
Heather Adkins, Google’s vice president of security engineering, said the three organisations had been informed about what happened.
“We ensured the three entities were made aware, and we worked with our training partner on the changes they’ve now made to their testing processes,” she said.
“These events highlight the importance of training powerful AI models to act responsibly.”
When a controlled test reaches the real world
The incidents point to a growing challenge for companies testing AI agents that can search the internet and interact with computer systems.
Irregular said the model was not supposed to have internet access during the exercise, but that access was unintentionally available. That meant Gemini could search beyond the simulated environment and encounter real-world information and credentials.
The company said relevant AI labs were notified in late July and that the known issues on its side had been fixed.
The Gemini incidents are also part of a wider pattern emerging around AI security testing. Similar incidents involving models from Anthropic, OpenAI and Meta have been reported in recent months, with AI systems reaching real companies or services while being evaluated.
Google said the Gemini incidents did not cause harm to the three companies and that it did not consider the behaviour an example of model misalignment. The company also notified the affected organisations.
But the episode raises a more practical question for the industry: as AI models become better at finding information, handling credentials and taking actions without step-by-step human instructions, how tightly can their testing environments be kept separate from the real internet?
In Gemini’s case, the model eventually recognised that it had reached real companies and stopped. The fact that it was able to reach them in the first place is what has made the incident significant.
