Google's Gemini AI breached three real companies during a security test

In May 2026, Google's Gemini AI mistakenly accessed the systems of three real companies during a cybersecurity exercise, stopping itself after realizing the error. No damage was reported. The incident occurred when Gemini, tested by AI security firm Irregular, confused real businesses with fictional targets in a closed environment due to a misconfiguration granting internet access. It guessed passwords for one company and used public credentials for two others. Google decided not to publicly disclose the event, citing Gemini's self-correction and lack of harm. Researchers learned of it in late July, and details emerged after media inquiries.