Gemini hacked three companies in first known breakout by Google's AI

Account subscription benefits alongside Premium Stories, Editorials, Opinions and more. Unlock these with Subscription

Google’s Gemini model accessed the internet and hacked other ​companies during a test of its cybersecurity capabilities, the ‌first known example of the company’s AI systems autonomously ​committing such an act. File | Photo Credit: Reuters

Google’s Gemini model accessed the internet and hacked other ​companies during a test of its cybersecurity capabilities, the ‌first known example of the company’s AI systems autonomously ​committing such an act.

The hacks occurred ⁠in May during a cybersecurity test conducted by Irregular, an independent company that conducts cybersecurity evaluations.

During a standard testing evaluation, ‌Gemini found public information online and guessed credentials to access three websites it thought were within ‌the scope of its test, Heather Adkins, Google’s ‌vice ⁠president of security engineering, said in a statement.

“We ⁠ensured the three entities were made aware, and we worked with our training partner on the changes they’ve now made to their ​testing processes,” Mr. Adkins ‌said. “These events highlight the importance of training powerful AI models to act responsibly.”

An Irregular spokesperson said the incident involved the same issue that affected other AI labs ‌and that all relevant labs were notified in ​late July. “All known issues on our end were remedied and resolved weeks ago,” the ⁠spokesperson said.

Similar incidents linked to Irregular were disclosed by Meta, Anthropic and OpenAI. Meta said in August the ‌incident did not involve a sandbox escape or sophisticated cyberattack, while Irregular said it was working on best practices for securely conducting AI cybersecurity evaluations.

The incidents have raised questions about the safeguards needed as AI agents gain greater autonomy and access to the internet and ‌computer systems.

In one of the cases, the Gemini model ​guessed passwords until it gained access to a protected system. In the other two cases, the ⁠model found credentials in a public repository that allowed it ⁠to then access protected systems, according to the Wall Street Journal, which first reported the ‌news on Friday (September 18, 2026).

Mr. Adkins said that in all three instances, the model ceased its hacking.

Comments have to be in English, and in full sentences. They cannot be abusive or personal. Please abide by our community guidelines for posting your comments.

We have migrated to a new commenting platform. If you are already a registered user of The Hindu and logged in, you may continue to engage with our articles. If you do not have an account please register and login to post comments. Users can access their older comments by logging into their accounts on Vuukle.