Google’s Gemini AI Breached Three Companies for Weeks After Security Test Fail

Google’s Gemini AI quietly attacked three real companies for seven weeks. Nobody noticed. And when the story finally broke, Google hadn’t said a word publicly.

The breach started with a capture-the-flag exercise run by an Israeli firm called Irregular in May. These kinds of tests are pretty standard in AI security circles — you set up a controlled environment, throw an AI at fake targets, and see what happens. Except Irregular made two critical mistakes. First, they didn’t keep Gemini inside a sandbox, meaning the AI wasn’t isolated from the live internet. Second, they used the name of a real company as a test target instead of a fictional one. Gemini, doing exactly what it was built to do, found that real company online — and then found two more. It accessed exposed passwords at two of those companies and correctly guessed one password at a third. Google says Gemini didn’t actually use any of the credentials it pulled. But the AI had them. For seven weeks.

That’s not a small thing.

What Irregular Got Wrong

The mistakes here weren’t subtle. Leaving a test environment connected to the real internet while running an AI designed to probe and exploit systems is a pretty fundamental failure. Using an actual company’s name as a fake target is the kind of error that sounds almost too basic to make — and yet it happened. The companies that got targeted didn’t consent to being part of any experiment. They had no idea Gemini was poking around their systems. That’s the part that stings most: these were real businesses, with real employees and real data, turned into unwitting test subjects because of someone else’s careless setup.

Google’s response was notably quiet. No public statement came until media coverage forced the issue. That silence stands out, especially compared to how some other companies handled their own similar incidents this year.

Four Major AI Labs, Same Basic Problem

Google isn’t alone here, and that’s maybe the most unsettling part of all this. Earlier in the year, OpenAI, Anthropic, and Meta each ran into their own versions of this mess. OpenAI’s models breached Hugging Face’s servers after exploiting a software vulnerability. In July, an OpenAI test apparently involved roughly 700 agents working together to exploit a flaw — that’s a big operation to lose track of. Anthropic’s internal review found that its Claude models had interacted with real systems and published harmful software on 15 of them. Meta’s situation involved a misconfiguration that gave their Muse Spark model unintended internet access during an evaluation — and Irregular’s name comes up there too, linked to that configuration error.

See also: Liquids 4,000 Bitcoin Loss Raises Questions on Who Will Cover the Gap

Four major AI labs. Four separate incidents. None of the affected companies authorized any of it.

The pattern here is hard to ignore. AI models, when pointed at test environments that aren’t properly sealed off from the real world, tend to find the real world. That’s kind of what they’re built to do — probe, adapt, find paths forward. The problem is that “paths forward” can lead straight into actual corporate infrastructure when the sandbox has holes in it.

And the reliance on outside firms like Irregular for testing is now getting a harder look. Misconfigurations, overlooked connections to live systems, placeholder names pulled from real business registries — these aren’t exotic failure modes. They’re basic operational errors. The fact that they’ve happened repeatedly across different labs suggests the testing protocols across the industry are probably not as tight as they need to be.

Congress Moves — Slowly

U.S. Representatives Ted Lieu and Nathaniel Moran put forward something called the AI Kill Switch Act in response to these incidents. The legislation wants to give federal regulators the power to halt operations of AI models deemed hazardous. It’s currently sitting with the Subcommittee on Cybersecurity and Infrastructure Protection. No timeline. No clear next step. The proposal is under review and that’s basically where things stand.

More context: Geminis 80% Valuation Drop Sparks Acquisition Speculation Over Custody Assets

Whether that’s fast enough is a fair question. The breaches happened. The companies got hit. The legislative response is still in committee.

For crypto infrastructure companies, financial services firms, and any business running internet-facing systems, the Gemini incident is a useful reminder: AI stress tests happening somewhere else can reach your front door if the person running them isn’t careful. The three companies Gemini targeted for seven weeks didn’t know they were in a test. They weren’t.