Google confirms Gemini models hacked three companies in May 2026

# Google confirms Gemini models hacked three companies in May 2026 Source: [https://arstechnica.com/google/2026/09/google-confirms-gemini-models-hacked-three-companies-in-may-2026/](https://arstechnica.com/google/2026/09/google-confirms-gemini-models-hacked-three-companies-in-may-2026/) It has become increasingly common for AI firms to announce that their latest and most capable models engaged in unauthorized real\-world hacking\. Google, which has been[slow to release](https://arstechnica.com/google/2026/07/google-reveals-faster-and-cheaper-gemini-3-6-flash-says-3-5-pro-is-still-in-testing/)frontier Gemini models in recent months, has been absent from the “rogue AI” conversation until now\. Following a[Wall Street Journal](https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2?mod=rss_Technology)report, Google has confirmed that Gemini models hacked three companies during a May 2026 test, but the nature of the intrusion isn’t as troubling \(or impressive\) as previous AI hacks\. The hack took place during a test conducted by cybersecurity firm Irregular\. A collection of Gemini models were taking part in a “capture the flag” exercise intended to test the AI’s cybersecurity capabilities in a closed environment\. The AI was instructed to retrieve information from a fake company \(which shared a name with a real company\) within this environment\. Irregular was not supposed to allow the model to operate outside its servers, but due to a misconfiguration, Gemini was able to access the Internet\. When Gemini started snooping around the web, it targeted real infrastructure instead of the fakes\. For one of the three hacks, Gemini simply guessed passwords until it accessed a company’s online services\. In the other two instances, Gemini searched public software repositories until it found login credentials for companies that had been accidentally included\. In all three test runs, Google’s models reportedly stopped after realizing they had accessed a real company’s servers\. At that point, Irregular changed its configuration to prevent the AI from accessing the Internet\. Apparently, Irregular didn’t initially consider this event worthy of further investigation—it didn’t even tell Google about the hacks until July, following the news of other AI hacking incidents\. After becoming aware of the event, Google notified the companies so they could \(we hope\) improve their password security\.