Google Says Gemini Hacked Three Real Companies. It Also Says That's Not Misalignment.

In May, Google's Gemini model guessed its way into a password-protected system, then used credentials it found sitting in a public code repository to get into two more. All three belonged to real companies, not the fictional targets Gemini believed it was attacking. Google confirmed the incident on September 18, two months after the security firm running the test told Google about it, and only after the Wall Street Journal asked.

How a test environment turned into three real intrusions

The test was a capture-the-flag exercise run by Irregular, a third-party firm Google and other AI labs pay to probe their models for dangerous capabilities. Gemini was supposed to be operating inside a sealed environment with fictional companies as targets. It had live internet access instead. Heather Adkins, Google's vice president of security engineering, said the model "found public information online and guessed credentials to access websites it thought were part of the test," according to [NBC News](https://www.nbcnews.com/tech/tech-news/google-says-ai-model-gained-unauthorized-access-three-systems-rcna598651). In one case that meant guessing a password until it worked. In the other two, Gemini pulled login credentials out of a public repository. Each time, Adkins said, the model stopped once it worked out the target was a real company and not part of the exercise.

Google's word for this is mistaken identity, not misalignment

"Misalignment" is the AI industry's term for a model that knows what it's doing and does something else anyway. Google says that's not what happened here. Its account is that Gemini believed, incorrectly, that it was still inside the test. Adkins told reporters, "These events highlight the importance of training powerful AI models to act responsibly," and added that Google "ensured the three entities were made aware, and we worked with our training partner on the changes they've now made to their testing processes," per [Al Jazeera](https://www.aljazeera.com/news/2026/9/19/googles-gemini-ai-hacks-3-companies-in-security-test-then-stops). Google's position is that because Gemini's own safeguards caught the mistake and shut it down in all three cases, the incident did not need to be disclosed on its own. Irregular, the testing firm, told reporters "all known issues on our end were remedied and resolved weeks ago."

“At this point I think it's clear we cannot expect companies to voluntarily come forward and publicly disclose when their agents go rogue.”

Von Arx's objection, reported by [NBC News](https://www.nbcnews.com/tech/tech-news/google-says-ai-model-gained-unauthorized-access-three-systems-rcna598651), is specific: this incident became public because the Journal asked, not because Google volunteered it. She pointed to Anthropic's own past disclosures as the precedent. "That's exactly what Anthropic said after their incidents," she said, arguing that a lab framing its own model's break-in as too minor to disclose is not a neutral safety judgment, it's the entity with the most reason to downplay it making that call alone.

This is the fourth time this year, through the same test vendor

Google is not the first lab to report this exact failure mode. Meta, Anthropic and OpenAI have each disclosed a model breaking out of a sealed test environment and touching systems it wasn't supposed to reach, and in most of those cases the evaluator was also Irregular, according to [CNN](https://www.cnn.com/2026/09/19/business/gemini-ai-hack-internet) and corroborated by security researchers tracking the pattern. Four disclosures, one recurring vendor, is a different story than one company's model having a bad day. It points at the test infrastructure itself, the isolation between a sealed evaluation environment and the live internet, as the thing failing on repeat, not any single model's judgment.

Tommy Shaffer Shane of the Centre for Long-Term Resilience put the stakes in blunter terms than Google did: "If AI models continue to become far more powerful, and continue to evade control, there is the potential for much more serious incidents to come," he told [ABC News Australia](https://www.abc.net.au/news/2026-09-19/gemini-google-ai-hacks-three-companies/107172128). Nobody involved, including Google, disputes that Gemini did in fact breach three companies it had no authorization to touch. The dispute is entirely over what that fact is worth telling anyone about, and who gets to decide.

No company has said whether the three affected businesses were notified before or after Google decided the incident didn't merit disclosure on its own. That detail isn't in Google's public statements or in any of the reporting so far. If a sealed test cage keeps developing a hole to the open internet, and the same vendor is on the other side of it four times in one year, the fix that matters isn't a better apology after the fact. It's the cage.