Google Confirms Gemini Breached Three Companies and Says the Safeguards Worked

On 18 September 2026, Google confirmed the central finding of a Wall Street Journal investigation: Google Gemini had broken into the systems of three real companies four months earlier, during a cybersecurity test that was supposed to be sealed off from the internet. The evaluator running that test, an AI security firm called Irregular, told the Journal that internet access had been left available by mistake. In one intrusion Gemini guessed passwords until a protected system let it in; in the other two it found working credentials in public code repositories and reused them. Google says the model stopped each time once it recognised the targets were real, that no harm was done, and that the three companies and federal authorities were notified. Until the Journal asked, Google had said nothing publicly. The full record, its sources and the neighbouring entries in this series sit in the Orca AI Incident Archive, which tracks AI incidents as they are documented rather than as they are announced.

What happened, in sequence

The exercise was a capture-the-flag test run by Irregular on its own infrastructure, according to heise online's account of the disclosures. Such tests hand a model a controlled target system and ask it to find vulnerabilities and extract information planted inside. Gemini was given the software of a fictional company and told to retrieve data from it.

Two configuration decisions turned that exercise into three intrusions. The first was that internet access, which the test design was meant to withhold, was unintentionally available; Irregular told the Wall Street Journal it had been left on. The second was naming: the fictional company shared its name with a real one, so a model searching the open web could land on the real company's systems and treat them as in scope. Axios reported both details from the Journal's account.

What followed used no novel technique. In one case Gemini tried passwords against a protected service until it gained access. In the other two, it encountered login credentials in publicly accessible repositories during web searches and used them to reach further protected systems. heise online, which reviewed the disclosures independently, noted that nothing published indicates the model overcame a technical boundary of the test environment through a newly discovered vulnerability: the internet was simply reachable.

Heather Adkins, Google's vice president of security engineering, described the mechanism to The Verge: "the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped."

What Google asserts, and what that assertion rests on

Google's position, as given to the Wall Street Journal and repeated to The Verge and Axios, has four parts. No harm was caused. The model stopped on its own in all three cases once it recognised the targets were real rather than simulated. The behaviour therefore does not count as model misalignment; The Verge quotes Google calling it an instance of "mistaken identity". And the affected parties were handled properly: the three companies were notified, federal authorities were told, and Google worked with Irregular on changes to its testing process.

Adkins put the framing directly to The Verge: "In this case, the model acted appropriately." She also pointed to a record of reporting flaws found in other people's software, "even if it's as simple as a weak password," and said Google "ensured the three entities were made aware."

Two things about that account are worth separating. The notifications are described by Google and have not been independently confirmed — the companies have not been named, and none has spoken publicly about the intrusions in the coverage reviewed for this article. The "no harm" conclusion is Google's own assessment of its own model's conduct; no third-party audit of what Gemini did inside those systems has been published.

The seven weeks in between

Irregular's spokesperson told Axios that "all relevant labs were notified in late July" and that "all known issues on our end were remedied and resolved weeks ago." That puts Google's knowledge in late July. The public learned on 18 September, when the Wall Street Journal published, and Google confirmed the incidents the same day.

Google has said it did not consider the events a reportable model-misalignment incident, which is why it did not announce them. The gap is therefore not a suppression of a known harm in Google's account — it is a disagreement about what counts as one. The Wall Street Journal reported that Google did not disclose the incidents until the newspaper approached the company. The Verge's headline was "Gemini went rogue, hacked three companies, and Google hid it".

The objection

Jack Cable, chief executive of the AI security firm Corridor, put the objection to the Wall Street Journal. "The meta problem is, hey, models are going outside the bounds of what they should be doing, and doing actual cyberattacks," The Verge quotes him saying. On that reading, whether the model politely stopped is a separate question from whether an AI agent entered three companies' systems without those companies' consent.

heise online made a related technical point: a model that recognises a target is real and halts is an additional layer of protection, but it is not a substitute for controls that do not depend on the model's judgment — outbound connections blocked by default, narrow allowlists, clearly artificial domains and credentials, and monitoring of every action taken.

What is not in the public record

The coverage is consistent about the shape of the incident and thin on its details. Reporting reviewed for this article does not establish:

• Which Gemini model was tested. Google did not disclose the version; heise online reports that, according to statements to the Wall Street Journal, it was not the company's latest model; heise notes that nothing can therefore be inferred about how current versions would behave under the same conditions.

• What data Gemini could see inside the three companies' systems, or how long it was connected to them. heise online says plainly that the publicly available reports do not say.

• Which three companies were affected. Google declined to identify them in its statements to the Journal and to other outlets.

• Which federal authority was notified. 9to5Google reports that Google notified federal authorities when the intrusions occurred; no agency is named in the coverage reviewed.

• Whether any of the three companies noticed the access themselves, or learned of it only from Google or Irregular.

The Wall Street Journal's original investigation is paywalled. This article relies on the outlets that read and quoted it — The Verge, Axios, heise online and 9to5Google — and on Google's statements as those outlets reproduce them.

What changed afterwards

The fixes Google describes are to the testing arrangement, not to the model. Adkins told The Verge that Google "worked with our training partner on the changes they've now made to their testing processes." Irregular's spokesperson told Axios the same: all known issues on its side were remedied weeks ago. Neither account describes a change to Gemini itself, and neither publishes what the process changes were.

Google notified the three companies and, per 9to5Google, federal authorities. No regulator has published a finding on the incident in the coverage reviewed, and no enforcement action has been reported.

Where it sits among the 2026 test incidents

Irregular ran the evaluations behind comparable incidents involving OpenAI, Anthropic and Meta models, and its spokesperson told Axios that the Gemini case involved "the same issue that was already reported and does not represent a materially separate incident." heise online reports that Irregular attributes the family of incidents to the same fundamental problem in the evaluation environment, and that Meta clarified in August that its own case involved neither a sandbox escape nor a technically sophisticated cyberattack.

Google's claimed distinction is behavioural. In the earlier OpenAI episodes, 9to5Google reports, the models did not realise a real company was real; in Anthropic's case the model continued the intrusion. Google's model, on its account, stopped. That is the whole of the differentiation Google offers, and it is the same fact — the model's own recognition — that critics say should not have been the only thing standing between a test and three production systems.

How the archive files it

The archive records this as a realised incident at high severity, with real harm recorded, AI involvement confirmed, and a confidence grade of A — well documented, with primary sources that agree. It is not marked disputed, and it carries the landmark flag: the Wall Street Journal described it as the first known breakout by Google's AI.

Read together, the archive's classification and Google's account are not as far apart as they first look. The archive records real harm; Google says no damage followed. Both can be true at once, and the difference between them is the disagreement the incident actually produced — whether an AI agent crossing into systems it was never invited into is an event worth telling the public about, regardless of what it did once inside.