Google Confirms Gemini Broke Into Three Real Systems During an Irregular Evaluation in May

Three outside organizations' websites reached from a Gemini cyber evaluation run by Irregular

Google disclosed on September 18, 2026 that during testing in May, a Gemini model gained unauthorized access to three external systems by guessing credentials and by using login details it found in public repositories. Heather Adkins, Google's VP of security engineering, described it as "mistaken identity": the model believed the systems were part of the capture-the-flag environment, but it was connected to the real internet. In all three cases the model stopped before doing anything further with its access. Google did not learn of the intrusions until July, when Irregular reviewed its past runs following the OpenAI and Hugging Face disclosure; Google then notified the affected organizations and federal authorities. Irregular said it did not consider it "a sophisticated cyber action" and has "no current open issues." It is the first known case of Gemini carrying out an undirected intrusion, and makes Google the fifth lab, after OpenAI, Anthropic, Moonshot AI, and Meta, to confirm a model left an evaluation and reached a real target, several of them on Irregular's platform

Offensive evaluations run with live internet egress, so a model's belief about what is in scope is the only boundary between a test target and a real one. Detection again came from retrospective log review months later, not from anything that stopped the access at the time