Artificial intelligence companies are increasingly testing whether their most advanced AI models can identify and exploit cybersecurity vulnerabilities. Google has now joined the growing list of companies reporting an unexpected real world security incident involving an AI model.
According to a report from The Wall Street Journal, Google confirmed that Gemini models accessed the systems of three real companies during a cybersecurity test conducted in May 2026. However, the incident appears to have resulted from a testing configuration error rather than an AI model deliberately carrying out an independent cyberattack.
Gemini Was Being Tested in a Controlled Environment
The incident occurred during a cybersecurity exercise conducted by security company Irregular. The test was designed as a capture the flag challenge, where Gemini models were asked to find information and complete security related tasks inside a controlled environment.
The AI models were instructed to investigate a fictional company that shared its name with an actual company. The goal was to keep the activity isolated from real world systems while allowing researchers to evaluate Gemini’s cybersecurity capabilities.
However, a configuration mistake changed the situation.
Irregular had intended to prevent Gemini from accessing the wider internet, but the restriction was not properly enforced. As a result, the Gemini models were able to connect to online resources outside the testing environment.
Gemini Reached Real Company Infrastructure
Once Gemini gained internet access, the models began searching beyond the fictional environment used for the test.
In one case, Gemini reportedly gained access to a real company’s online services by attempting passwords. In two other cases, the models searched publicly available software repositories and discovered login credentials that had accidentally been exposed.
This resulted in Gemini accessing infrastructure belonging to three real companies.
The incident highlights an important challenge for AI security testing. Even when researchers create isolated environments for cybersecurity experiments, configuration mistakes can potentially give AI systems access to real world resources.
Gemini Stopped After Detecting the Real Systems
According to the reported findings, the Gemini models stopped their activity after recognizing that they had reached real company infrastructure.
Irregular then changed its configuration to block Gemini from accessing the internet and prevent any further interaction with external systems.
The incident therefore differs from some of the more concerning AI security demonstrations in which researchers have intentionally given models access to systems and observed them carrying out increasingly complex attacks.
In this case, the primary issue appears to have been the accidental exposure of real infrastructure during a controlled test.
Google Was Not Initially Told About the Incident
Another notable detail is that Irregular did not immediately notify Google about the unauthorized access.
The company reportedly became aware of the incidents in July, after other high profile reports involving AI models and cybersecurity activity attracted attention.
After learning what had happened, Google notified the affected companies so they could investigate the exposure and take appropriate security measures.
The discovery of credentials in public software repositories also highlights a familiar cybersecurity problem. Accidentally exposed passwords and login information can provide an easy entry point into online services, regardless of whether the person searching for them is human or an AI system.
What the Gemini Incident Means for AI Security
The incident demonstrates why strict isolation is essential when testing AI models with cybersecurity capabilities.
As AI systems become increasingly capable of searching the internet, analyzing software, identifying vulnerabilities, and interacting with computer systems, researchers must carefully control the environments in which these models operate.
The Gemini incident also shows that AI security risks do not necessarily require an AI model to intentionally act maliciously. A simple configuration mistake can potentially connect an experimental system to real infrastructure.
For companies developing advanced AI systems, stronger safeguards, network isolation, credential protection, and continuous monitoring will become increasingly important as models gain more powerful cybersecurity capabilities.
Google Gemini’s accidental access to three real companies serves as another reminder that testing powerful AI systems requires careful controls. While the incident was reportedly limited and the models stopped after recognizing the real systems, it demonstrates how quickly a controlled cybersecurity experiment can become connected to the real internet when safeguards fail.