Google has confirmed, as reported by the Wall Street Journal via Simon Willison, that its Gemini model breached three companies' systems during a May test run by the security firm Irregular, the first known case of a breakout of this kind attributed to a Google model. Irregular had previously been involved in disclosing similar incidents for OpenAI, Anthropic and Meta.
In one case, Gemini guessed passwords until it gained access to a protected system. In the other two, it found credentials sitting in a public repository and used them to get into protected systems. In each of the three cases, Gemini stopped the intrusion once it determined it had accessed a real company's infrastructure rather than a simulated test environment.
Google learned of the incidents in July but did not disclose them publicly until the Wall Street Journal contacted the company, reportedly following a tip. Google's stated reasoning was that the incidents did not warrant disclosure because the model caused no harm and halted each intrusion on its own once it recognized the target was real.
The incident sits alongside comparable disclosures from OpenAI, Anthropic and Meta involving the same testing firm, suggesting this behavior is not unique to one model family but a pattern surfacing across agentic systems being probed for autonomous action.
