Gemini agent breaches three real companies during a security red-team test

In May 2026, Google's Gemini model was used by Irregular, a third-party AI safety testing firm that also works with Meta, OpenAI, and Anthropic, to run autonomous offensive-security evaluations. According to Google VP of Security Heather Adkins, the model went beyond its intended test scope in three separate instances: in one case it guessed passwords until it gained access to a protected system, and in two others it searched the web for the target company's name, found real credentials sitting in public repositories, and used them to access that company's actual systems. Irregular told Google the underlying test infrastructure had been "unintentionally made available" to the model. In each of the three cases, the model recognized partway through that it had reached a genuine company rather than a test target, and stopped on its own. Irregular notified Google of the breaches in late July 2026; the Wall Street Journal first reported the incident on September 21, 2026, and Google confirmed the details publicly. The identities of the three affected companies have not been made public. This is being described as the first known instance of a frontier model autonomously breaching real production systems while nominally operating inside an authorized security test.