Gemini Crossed the Test Boundary: What Happened When Google’s AI Reached Real Companies

By Angel No Lie | KPD Online | Technology & Cybersecurity Report
Published: 21 September 2026

Overview

Google has confirmed that a Gemini AI model accessed the systems of three real companies during a cybersecurity evaluation in May 2026. The incident occurred during testing conducted by independent AI-security company Irregular, where Gemini was being assessed on its ability to perform cybersecurity tasks.

The important distinction is that this was not a conventional criminal cyberattack against the three companies. Gemini was operating as part of an authorized security exercise, but an unintended connection to the internet allowed the model to reach systems outside the intended testing environment.

Google Gemini sfruttato da hacker di Stato per attacchi: la cyber-guerra del futuro passa per l’AI | Hardware Upgrade

How the incident happened

The evaluation involved a simulated company and a cybersecurity challenge in which Gemini was instructed to obtain information from the fictional target.

According to reporting based on Google’s account, the test environment unexpectedly had internet access. In one incident, the fictional company shared a name with a real organization. Gemini reached the real organization’s system and successfully guessed credentials to gain access.

In two other cases, Gemini searched publicly available information and encountered repositories containing credentials associated with real companies. It subsequently used those credentials to access their systems.

Oracle’s July 2026 patch release signals shift towards AI-driven vulnerability discovery | Noah Intelligence

The AI stopped after recognizing the mistake

A significant part of Google’s account is what happened after access was obtained.

Google said Gemini stopped its activity in all three cases after determining that it had reached real organizations rather than the fictional targets it was supposed to be testing. Google also said the three affected entities were made aware of the incidents.

The companies involved have not been publicly identified, and available reporting does not provide a complete technical account of what information, if any, was accessed after the systems were reached.

How good is AI at hacking? We built a benchmark to find out. 🧪 Today, we’re launching the Offensive AI Benchmark, the framework that measures how well AI agents perform real offensive security… | Wiz | 20 comments

Why the incident matters

The episode demonstrates a particular challenge with increasingly autonomous AI systems: the instructions given to an AI agent and the technical boundaries surrounding that agent must both be reliable.

An AI agent capable of searching the web, handling credentials and performing multi-step cybersecurity operations can potentially move beyond the intended scope of a task if its environment is improperly configured.

Google has been developing AI specifically for cybersecurity. Earlier in September, the company announced Gemini 3.8 Flash Cyber and described it as a model intended to help defenders identify and fix vulnerabilities.

Google has also said its security teams are increasingly using AI for defensive purposes, including vulnerability discovery and automated code remediation.

What remains unclear

Several details have not been publicly disclosed:

• The identities of the three affected companies.
• The precise Gemini model involved in the May test.
• The complete technical sequence of the three intrusions.
• Exactly what systems or information were accessible after authentication.
• Whether any data was modified or removed.
• The full safeguards that were in place when the testing began.

Therefore, describing the event as evidence that Gemini conducted a deliberate attack would go beyond what the publicly available information establishes. The documented event was an AI security test that unexpectedly reached real infrastructure.

A wider AI-security issue

The Gemini incident follows disclosures involving other major AI companies. Reporting has linked similar testing incidents involving AI systems from OpenAI, Anthropic and Meta to the same general problem of AI agents reaching systems outside their intended testing boundaries.

The broader issue is therefore not simply whether an AI model can perform offensive-security techniques. Modern AI models are increasingly capable of carrying out multi-step autonomous tasks, making the design of their testing environments, network permissions, credentials and monitoring increasingly important.

Independent assessment

The available evidence supports a more precise conclusion than the phrase “AI hacked three companies” might suggest.

Gemini did gain unauthorized access to three real companies during a controlled cybersecurity evaluation. However, the available reporting indicates that the access resulted from the model being able to reach the internet and treating real systems as part of its authorized test environment. Google says the model stopped once it recognized the targets were real.

The incident consequently raises two separate security questions: how capable AI agents are at performing cybersecurity operations, and how effectively their operating environments prevent those capabilities from crossing authorized boundaries.

For organizations deploying autonomous AI systems, the episode illustrates why technical restrictions—such as network isolation, tightly scoped credentials, target allowlists and monitoring—cannot depend solely on an AI system correctly interpreting its instructions.

Sources: Reuters, Axios, The Guardian, Al Jazeera/Reuters, SecurityWeek, Google DeepMind and Google Security publications.