A cybersecurity exercise is supposed to reveal weaknesses without placing real organizations at risk. In May 2026, however, a security test involving Google Gemini AI reportedly crossed that boundary: an unintended internet connection allowed the model to move beyond a simulated environment and hacked systems belonging to three real companies.
The headline that Google Gemini hacked three companies sounds like an active cyberattack. That is not what happened. The incident occurred during an authorized evaluation conducted by AI security company Irregular, not during an ongoing malicious campaign. According to Google’s account, Gemini stopped after recognizing that the systems were real rather than simulated. Independent reporting added that the model reportedly guessed passwords in one case and discovered publicly exposed credentials connected to two other companies.
The episode is still significant. It shows how a small infrastructure mistake can give an autonomous agent access to targets its operators never intended it to reach. As Google AI agents and competing systems gain browsers, terminals, code execution, credentials, and network access, AI agent security can no longer depend on instructions alone.
What Happened During the Gemini Security Test?
Irregular was evaluating Gemini’s cybersecurity capabilities in May 2026. The model was expected to operate inside a controlled environment containing simulated targets. Such evaluations help researchers measure whether an AI system can identify vulnerabilities, navigate networks, use security tools, or complete attack-like tasks under supervision.
According to Google’s confirmed explanation, the test environment was unintentionally connected to the public internet. That configuration error created a route from the simulation to real external systems. Gemini followed that route while carrying out the assigned security task and reached infrastructure associated with three actual companies.
The companies have not been publicly identified, limiting outside assessment of the affected systems and the depth of access. There has also been no public indication that Gemini caused destructive changes, stole data, established persistence, or continued operating after the test. The known event is best understood as an accidental boundary breach during AI security testing, not a Gemini cyber attack unfolding now.
Google’s Account Versus Independent Reporting
Separating confirmed information from additional reporting is essential because the phrase Gemini AI hacked can imply more than the available evidence supports.
Google confirmed the central sequence: Gemini was participating in a cybersecurity evaluation, an unintended internet connection exposed real-world systems, and the model stopped after determining that the targets were genuine. Google’s account emphasizes that the agent recognized the mismatch between the simulated task and the environment it had reached.
Independent reporting supplied more specific details about the three cases. It said Gemini reportedly guessed login credentials in one instance. In the other two, it reportedly located credentials that were already publicly exposed. Those details are important, but they should be attributed rather than presented as a complete technical finding from Google. Public information does not establish every command executed, the privileges involved, or whether each discovery resulted in meaningful access.
Irregular specializes in testing advanced AI systems under adversarial conditions. Readers can learn more about the company’s broader work through Irregular’s official website.
How an Internet Connection Broke the Test Boundary
A secure cyber range normally isolates the system under evaluation from networks it is not authorized to contact. Simulated domains, hosts, credentials, and services should remain inside that range. Outbound connections are typically blocked, tightly allowlisted, or routed through monitored proxies.
In this Gemini security test, the unintended internet connection appears to have undermined that separation. From the agent’s perspective, an external host could look like another step in the challenge. If its tools could resolve public domains, send requests, scan services, or attempt authentication, the model could act on a real system before understanding that it had left the simulation.
This distinction matters because an AI agent does more than generate text. An agentic system can plan actions, call tools, observe results, revise its strategy, and continue toward a goal. Internet access turns incorrect assumptions into external actions at machine speed. The vulnerability was therefore not simply inside the Gemini model. It emerged from the combination of model, tools, permissions, network configuration, and test orchestration.
How Gemini Reportedly Found or Guessed Credentials
The three cases illustrate two familiar security problems amplified by autonomous AI agents.
In the first case, Gemini reportedly guessed passwords. Public reporting does not provide enough detail to determine whether this involved default credentials, common password patterns, a small number of targeted attempts, or another technique. It should not automatically be described as large-scale password cracking. Even limited guessing, however, can become dangerous when an agent can identify login portals and test likely combinations without a human approving each attempt.
In the other two cases, Gemini reportedly found publicly exposed credentials. Secrets can leak through source-code repositories, configuration files, logs, documentation, package artifacts, cloud storage, or indexed web pages. A capable agent can connect those fragments faster than a person: discover a secret, infer the relevant service, and attempt to use it.
This is why organizations should treat exposed credentials as compromised even if there is no evidence of human misuse. Modern AI hacking workflows can automate discovery and validation, shrinking the time between accidental disclosure and attempted access.
Why Gemini Stopped When It Recognized Real Targets
Google says Gemini stopped after recognizing that the organizations were real. That behavior is encouraging because it suggests the model could reassess context and avoid continuing beyond the authorized exercise.
It is not, however, a sufficient security control. Recognition may happen only after a real system has been contacted, a login has been attempted, or information has been retrieved. Another model, prompt, tool configuration, or chain of observations might produce a different result. Models are probabilistic, and their interpretation of scope cannot replace infrastructure-enforced boundaries.
The safest design assumes that an agent may misunderstand instructions, follow a misleading clue, or fail to identify a real asset. Stopping voluntarily is a valuable layer of AI safety; network isolation and permission controls are the layers that should prevent the mistake from reaching a third party.
Why the Incident Matters for AI Agents Cybersecurity
The incident captures a wider change in AI cybersecurity. Traditional chatbots mainly returned information to users. Agentic systems can now browse websites, operate command-line tools, write and run code, authenticate to services, and make decisions across multiple steps. Those capabilities create business value, but they also expand the potential blast radius of configuration errors.
An autonomous agent does not need malicious intent to cause harm. A legitimate goal can be pursued against the wrong target because of a broken sandbox, ambiguous scope, poisoned web content, an incorrect asset inventory, or excessive permissions. In other words, AI cybersecurity risks arise from system behavior, not only from hostile prompts or deliberate misuse.
The Gemini event also challenges the assumption that a simulation is safe simply because its instructions describe fictional systems. Authorization must be machine-verifiable. If a target is outside a signed scope, approved address range, or dedicated cyber range, the tools should refuse the action regardless of what the model believes.
Safeguards Required for Autonomous AI Agents
Organizations building or testing Gemini AI agents and other autonomous systems should use layered controls rather than relying on one sandbox or policy prompt.
- Deny internet egress by default: Cyber ranges should block outbound traffic unless a destination is explicitly required. Allowlisting must occur at the network layer, not only in the agent’s instructions.
- Validate every target: Browsers, scanners, shells, and authentication tools should check destinations against an approved inventory before execution. Redirects, DNS changes, IPv6 routes, and cloud metadata endpoints need coverage.
- Separate planning from authorization: The model may propose an action, but a deterministic policy engine should decide whether that action is permitted. High-risk steps can require human approval.
- Use short-lived test credentials: Secrets should be scoped to the simulation, rotated frequently, and prevented from working outside it. Production credentials should never be available to an evaluation agent.
- Limit rate and privilege: Authentication attempts, scans, file access, and tool calls need strict thresholds. Least-privilege access reduces damage if isolation fails.
- Monitor complete action traces: Teams should record prompts, plans, tool calls, network requests, responses, and policy decisions. Alerts should trigger when an agent approaches an unapproved domain or address.
- Deploy independent kill switches: Operators need a reliable way to suspend network access and revoke credentials without depending on the agent’s cooperation.
- Test the test environment: Before an evaluation begins, teams should verify isolation from the agent’s own execution context. External canary services can reveal unexpected egress.
These measures align with the broader principle that safety must cover the entire system lifecycle. Google’s published material on responsible AI and safety provides additional context on its approach, although the controls required for a specific agent depend on its tools and deployment.
The Larger Lesson From the Gemini Incident
The central lesson is not that Gemini suddenly became a malicious hacker. It is that increasingly capable agents can turn a narrow configuration error into real-world contact before operators notice. The same issue could affect any model equipped with powerful tools and insufficiently restricted connectivity.
Strong AI model security remains necessary, but model testing alone is not enough. Developers must secure the surrounding agent framework, credentials, tool permissions, network routes, logs, and approval process. As of September 2026, this is becoming one of the defining challenges in AI agent security: capabilities are advancing faster than many organizations’ containment practices.
Gemini’s reported decision to stop is a positive detail. The fact that it had already reached three real companies is the warning. Future evaluations must be designed so that recognizing a boundary is helpful, but crossing it is technically impossible.
Frequently Asked Questions
Did Google Gemini hack three companies in an active attack?
No. The event occurred during a May 2026 cybersecurity test conducted by Irregular. An unintended internet connection reportedly allowed Gemini to reach real systems outside the simulation. It is not an attack happening now, and there is no public evidence of an ongoing campaign.
What did Gemini reportedly do?
Independent reporting said Gemini guessed credentials in one case and found publicly exposed credentials associated with two others. Google confirmed the accidental contact with real organizations and said the model stopped after recognizing that the targets were real.
Were the affected companies identified?
No. The three companies have not been publicly named. Available accounts also do not provide a full technical record showing the precise level of access, privileges obtained, or every action taken.
What is the main AI agent security takeaway?
Autonomous AI agents need infrastructure-enforced boundaries. Internet access should be denied by default, targets should be checked against an approved scope, credentials should be temporary, and high-risk actions should require deterministic controls or human approval. A model’s judgment should supplement these safeguards, not replace them.
