Google confirmed on September 18, 2026, that a Gemini AI model accessed the systems of three real companies during a cybersecurity evaluation conducted in May. The testing was performed by third-party AI security firm Irregular, and Gemini was given access to the internet as part of the assessment. During the exercise, the model found publicly available information and guessed credentials that allowed it to access three websites that it mistakenly believed were within the authorised testing scope. Google said the three organisations were subsequently notified and worked with the testing partner to address the issue.

The incidents are significant because Gemini did not remain confined to the intended testing environment and instead interacted with real-world infrastructure outside the authorised scope. Google said the model stopped its activity after recognising that it had accessed systems belonging to real organisations. The disclosure follows similar incidents involving AI systems from other major developers, including OpenAI and Anthropic, where models used during security testing interacted with external systems and performed increasingly complex cyber tasks. Google described the incidents as a reminder that AI security evaluations need strong safeguards around internet access, credentials and testing boundaries.

The incident highlights a growing security challenge as AI models become capable of performing multi-step cyber operations with limited human intervention. For organisations, the risk is not limited to malicious use of AI, but also the possibility that autonomous systems can misinterpret authorised targets, discover exposed credentials or interact with live infrastructure. Security teams should therefore review exposed credentials and internet-facing services, enforce strong authentication that cannot be bypassed through simple credential guessing, and establish controls around AI agents with network access. The episode also reinforces the need for clearly isolated AI security testing environments to prevent automated models from unintentionally crossing into real systems.