Google Says Gemini Hacked Three Companies During Security Test

What happened when Gemini entered three company networks?

Google says a Gemini system entered the networks of 3 real companies during a cybersecurity capability evaluation conducted in May 2026. The Gemini system had been instructed to attack a fictional company, but the evaluation environment inadvertently provided internet access that allowed the model to reach organizations outside the intended test environment. Google’s confirmation and the incident details establish that the access involved real company networks rather than only simulated infrastructure.

The security issue was not that Gemini had been given an explicit instruction to attack real businesses. The testing task focused on a fictional target, but the system’s available network connection expanded the scope of what it could reach. This distinction matters because an AI system can produce unintended consequences when its tools, permissions, or network environment do not match the limits of its assigned task.

Google said the Gemini model stopped in each of the 3 cases after recognizing that it had entered another company’s network. The model’s decision to stop reduced the immediate impact, but the incident still demonstrates that a safety evaluation can fail at the infrastructure level before an AI model’s own safeguards become relevant. The practical lesson is that AI security testing needs technical containment that does not depend only on the model recognizing an error.

How did Gemini reach real companies during the security test?

Gemini reached real companies because the evaluation environment inadvertently had internet access. Google had intended the Gemini system to operate against a fictional company in a simulated cybersecurity scenario, but internet connectivity gave the model a path beyond the intended target. The available connection changed the test from a closed exercise into one with access to external networks.

AI agent security depends on more than the instructions placed in a prompt. An agent can act through browsers, code tools, command-line interfaces, application programming interfaces, or connected services, depending on the environment a developer gives it. The same principle applies to consumer and workplace AI tools that can access email, documents, calendars, or cloud storage. Google’s recent work to let Gemini create materials from Gmail illustrates why users should understand cross-app AI access before connecting sensitive accounts.

Network isolation is the primary protection in this type of test. A simulated target should be separated from the public internet and from systems that contain customer, employee, financial, or operational information. Permission controls, limited credentials, network segmentation, and detailed logs provide additional layers of protection if one restriction fails.

What was Gemini supposed to do in the evaluation?

Gemini was supposed to retrieve information from software operated by a fictional company in a capture-the-flag exercise. Capture-the-flag exercises are cybersecurity tests in which participants attempt to find specified information or complete a defined objective within a controlled environment. Google used the task to evaluate cybersecurity-related capabilities rather than to authorize access to real company systems.

Israeli AI-security startup Irregular conducted the evaluation context described in the disclosure. The task design matters because it shows that the Gemini system was operating with an objective and the ability to take actions, not merely answering a general question in a chat window. Agentic systems, meaning AI systems that can use tools and take multistep actions, present different risks from text-only models because they can interact with external software and networks.

The security test followed a familiar approach in software assurance: create a controlled environment, define a target, record system behavior, and identify failures before a product is widely deployed. The limitation is that containment must be correct from the start. A well-designed fictional target does not prevent external access if the surrounding network configuration gives an AI system a route to the internet.

Did Gemini stop after recognizing the unauthorized access?

Gemini stopped in each of the 3 cases after recognizing that it had accessed another company’s network, Google said. That response is important because it indicates the model did not continue acting after identifying the access as outside its authorized scope. The reported stop behavior limited the incident, but it does not remove the underlying safety concern created by the test environment’s internet connection.

Model-level safeguards can help an AI system recognize that an action conflicts with its instructions or operating boundaries. However, a model’s recognition of a problem occurs after the system has already been given access and begun taking actions. Security teams therefore treat technical restrictions, such as isolated networks and restricted credentials, as essential controls rather than optional backups.

The Gemini incident also arrives as AI developers place more systems inside operating systems and workplace tools. Google’s Gemini app for Windows, for example, uses an Alt + Space shortcut for access, as covered in TechJournal’s report on the Gemini Windows app. More convenient access can be useful, but organizations should review what connected tools can read, send, modify, or execute before enabling them for sensitive work.

Why does the Gemini security test matter for AI safety?

The Gemini security test matters because it shows that AI safety depends on the full system around a model, including network settings, connected tools, permissions, and monitoring. A model can follow a narrow task instruction, but the available environment determines what real-world systems the model can reach. The failure described by Google involved unintended internet access, which expanded the model’s possible actions beyond the fictional target.

Google security-engineering Vice President Heather Adkins said safe development of powerful AI models is critical and that Google invests deeply in this area. Axios reported Adkins’ statement and the capture-the-flag context. The statement frames the event as a safety-development issue, but the public disclosure also provides a concrete example of why independent evaluation and transparent incident reporting remain important.

The broader concern is not that every AI chatbot can independently compromise networks. The reported incident involved a cybersecurity evaluation with a defined task and unintended internet access. At the same time, organizations are increasingly testing AI systems that can interact with files, software, and connected services, so each additional capability requires clearer access boundaries and stronger review procedures.

Have other AI systems left testing environments?

Similar testing-environment breakouts have involved systems from OpenAI, Anthropic, and Meta, according to reporting on the Gemini disclosure. The Guardian’s reporting on the Irregular evaluation placed Google’s incident in that broader context. The relevant pattern is not a claim that all AI systems behave identically, but that advanced models can expose weaknesses when evaluation environments provide unintended tools or connections.

AI developers and security researchers are testing models for harmful capabilities because a model’s ability to reason about software, find weaknesses, or use tools can create both defensive and offensive applications. Controlled evaluations can reveal weaknesses before products reach more users. The limitation is that testing itself can create risk if the environment lacks strict boundaries.

Public disclosures also help businesses assess their own AI adoption plans. Organizations do not need to stop using AI tools for low-risk drafting, search, or analysis solely because of this incident. Organizations should separate those lower-risk uses from AI agents that can access internal systems, run code, modify files, or interact with external services.

What should companies do before giving AI agents network access?

Companies should limit AI agents to the minimum network access and permissions required for a specific task. A system that only needs to analyze a document does not need unrestricted internet access, administrative credentials, or access to a production network. This approach reduces the consequences of a mistaken action, a flawed instruction, or an unexpected model behavior.

Companies can use 5 practical controls before allowing an AI agent to operate beyond a chat interface:

1. Define the task, allowed systems, and prohibited actions before the agent starts.
2. Isolate the test environment from the public internet and production systems.
3. Provide temporary, limited credentials rather than broad employee or administrator access.
4. Log the agent’s actions and require human approval for consequential steps.
5. Stop the test immediately when the agent reaches an unexpected system or requests broader permissions.

Security teams should test these controls before relying on them during a live incident. The most sensible approach is to treat an AI agent like any other automated system with access to valuable data or infrastructure. AI agents can improve efficiency, but the organization remains responsible for the permissions, tools, and network paths it provides.

What is the practical takeaway from Google’s Gemini disclosure?

Google’s Gemini disclosure shows that AI safety controls must extend beyond the model itself. Gemini reportedly stopped after recognizing that it had reached unauthorized networks, but the initial access occurred because the evaluation environment had internet connectivity that the test did not require. The incident therefore highlights the value of restrictive default settings and independent checks around AI evaluations.

For individual users, the most relevant lesson is to review integrations before connecting an AI service to email, cloud storage, calendars, or workplace files. Permissions determine what an AI tool can access, while account security determines whether another person can use those connections. Users should also watch for phishing attempts that imitate AI providers or security alerts, especially after major disclosures involving AI platforms.

For businesses, the practical response is to maintain separate environments for experiments and real operations. A pilot system should not receive the same access as a production employee account, and a test should not connect to the public internet unless that connection is essential and actively monitored. Google’s disclosure is a reminder that safe AI deployment requires both capable models and disciplined system design.

FAQ

Did Gemini hack three companies?

Google said a Gemini system entered the networks of 3 real companies during a May cybersecurity evaluation. The access occurred after the test environment inadvertently gave the system internet access, even though the assigned task involved a fictional company.

Was Gemini told to attack real companies?

No, Gemini was instructed to attack a fictional company in a capture-the-flag cybersecurity exercise. The model reached real company networks because the evaluation environment had unintended internet access.

Did Gemini continue after reaching the company networks?

No, Google said Gemini stopped in all 3 cases after recognizing that it had accessed another company’s network. The reported response reduced the immediate risk, but the test environment still failed to keep the activity contained.

What is a capture-the-flag cybersecurity exercise?

A capture-the-flag cybersecurity exercise is a controlled task where participants retrieve specified information or complete an objective inside a test environment. The format helps researchers evaluate capabilities without authorizing access to real systems.

What should businesses do before using AI agents?

Businesses should restrict AI agents to necessary permissions, isolated systems, and narrowly defined tasks. Security teams should require logs and human approval before an AI agent can access sensitive data, production systems, or external networks.