Google Confirms Gemini Models Hacked Three Companies in May 2026 Test

Google has acknowledged that its Gemini models breached three companies during a test in May 2026, as reported by the Wall Street Journal. This event took place during a cybersecurity drill organized by Irregular. Within a controlled setting, several Gemini models engaged in a "capture the flag" challenge aimed at assessing their cybersecurity skills. The AI was tasked with obtaining data from a fictitious company sharing a name with a legitimate one. However, due to a configuration error, Irregular mistakenly permitted the models to connect to the Internet, which was not part of the plan. Once online, Gemini focused on actual infrastructure instead of the intended simulated targets. In one instance, the model cracked passwords to access a company's online services, while in the other two cases, it uncovered exposed login credentials from public software repositories. Google has been slow to roll out its advanced Gemini models recently and had previously not participated in conversations about "rogue AI." Reports suggest that the severity of this breach is less alarming than earlier AI-related hacks. The confirmation followed the Wall Street Journal's revelation of the incident.