Google Confirms Gemini Breached Three Real Company Networks During Security Test

Google disclosed this week that its Gemini model, while being evaluated for cybersecurity risk by third-party firm Irregular, found and used real credentials to access the live networks of three actual companies—not simulated targets—before recognizing the environment was real and stopping on its own.

The incident stemmed from a domain-naming collision: a fictional company name used in the test environment happened to match a real, live corporate domain. Instructions meant to describe a harmless simulation instead pointed Gemini at an actual internet-connected target.

Key points:

• Gemini found credentials in a public code repository, used them to guess additional passwords, and gained access to the real systems before halting once it recognized the environment did not match the test scenario

• Google's VP of Security Engineering, Heather Adkins, publicly confirmed the incident on September 19

• Irregular confirmed this is not an isolated Google problem: it notified OpenAI, Anthropic, and Meta of the same underlying vulnerability back in late July 2026

This elevates AI containment risk from a single company's disclosure into a documented, cross-industry pattern—the exact kind of systemic, shared vulnerability that is hardest for any one enterprise risk team to evaluate by looking at a single vendor in isolation.

Why It Matters: This confirms that AI containment failures are now an industry-wide pattern, not a one-company problem. Any organization giving AI agents real system access should be asking every vendor directly about this specific vulnerability class.