Google’s Gemini Agents Hacked Three Companies in Testing Breakout

Google has joined a growing list of AI labs admitting that test systems leaked into the real world. During cybersecurity evaluations in May, agents based on Gemini got internet access by mistake and then logged into the systems of three real companies. Google says the agents stopped on their own once they understood they were inside actual infrastructure, and the affected firms were not harmed.

The tests were run by Irregular, an Israeli start-up that evaluates AI models for dangerous behavior before release and also works with OpenAI, Anthropic, Meta and Google. In this case, an unspecified Gemini version was asked to pull data from fake companies. Internet access was supposed to be off, but a setup error turned it on anyway. That mattered because the fictional companies shared names with real ones, so the agents went after the real targets instead.

Google says the models used passwords they found online or guessed to get into the intended target and two other companies. Heather Adkins, Google’s vice president of security engineering, said all three instances stopped, that the affected entities were notified, and that Google worked with its training partner on changes to the testing process. Google did not disclose the incidents proactively; Irregular had already said in a blog post that unintended internet access had caused some models to take offensive actions in the real world.

The Gemini case lands in the middle of a much bigger argument over whether frontier AI should slow down. In recent weeks, OpenAI, Anthropic and Meta have also disclosed breakout incidents tied to Irregular’s testing. Some people want tighter rules, mandatory checkpoints and even international oversight. Others hear only a convenient panic campaign that would entrench the biggest players. Either way, the basic message is hard to miss: if the sandbox has a hole in it, these systems are already capable of walking through.