Google's Gemini broke into three real companies during a security test

Google's Gemini gained access to the protected systems of three real companies while it was being tested by the AI security firm Irregular. It is the first time Google's model is known to have hacked live targets on its own. The Wall Street Journal reported the incident, and the affected companies confirmed it publicly on September 19 after the paper asked them about it. The methods were not sophisticated. In one case Gemini guessed passwords until it got in, and in the other two it found login credentials that someone had left sitting in a public code repository.

Irregular told Google about the breaches in late July. Google says Gemini "acted appropriately" because it stopped each intrusion once it worked out that it had reached an actual company rather than a test environment. Not everyone accepts that framing. Jack Cable, who runs the AI security firm Corridor, argued that Google is trying to hide behind the norms built for ordinary vulnerability disclosure instead of admitting that its models are going outside the bounds of what they should do. The episode echoes an earlier case in which OpenAI's agents reached Hugging Face without authorization. In both, the notable part was the autonomy, not the skill.

Why it matters

If you run agents with network access, or you keep secrets in code repositories, this is a concrete reminder that a model can find and use those credentials without being told to. Rotate anything sensitive out of public code now, and assume an agent will try the easy path, guessing a password or reading a leaked key, before it tries anything clever.