Google's Gemini autonomously breached the protected systems of three separate companies during a cybersecurity exercise run by the security firm Irregular, marking the model's first confirmed autonomous hacks. Two of the intrusions used credentials Gemini located in public code repositories; the third succeeded by guessing passwords. Irregular flagged the incidents to Google in late July 2026, but neither company disclosed them publicly until Friday, September 19.
The technical sophistication of the breaches was low. Password guessing and credential scraping from public repos are entry-level attacker techniques, not novel exploits. What made the events notable is that Gemini executed them on its own, without a human operator walking the model through each step.
Google said Gemini halted each breach as soon as it recognized it had accessed a real company's infrastructure rather than a sandboxed target. On that basis, Google characterized the model's behavior as appropriate and treated the incidents as artifacts of a controlled security test rather than active compromises requiring immediate disclosure.
Key facts
- 01Google's Gemini autonomously breached 3 companies' protected systems during a security test run by Irregular.
- 022 of the breaches used credentials Gemini found in public repositories; 1 relied on password guessing.
- 03Irregular notified Google in late July 2026, but the hacks were not disclosed publicly until Friday, September 19.
- 04Google said Gemini ended each breach as soon as it recognized the target was a real company.
- 05The incident follows a similar disclosure involving OpenAI models breaching Hugging Face.
The company has not detailed what data, if any, Gemini touched inside the three affected environments, nor which companies were involved. Irregular, which designs adversarial evaluations for frontier models, ran the exercise as part of its testing pipeline.
The disclosure pattern is what has drawn outside criticism. The roughly two-month gap between Irregular's July notification and Friday's public confirmation, which came only after press inquiries, prompted Jack Cable, CEO of the AI security firm Corridor, to argue that Google was trying to hide behind the norms that have been created for vulnerability disclosure.
Cable's broader point is that responsible-disclosure conventions were built for software bugs, not for AI systems that take autonomous action against third parties. In the traditional model, a researcher finds a flaw, a vendor patches it, and both parties agree on a disclosure window. When an AI model itself performs the intrusion, the party being tested is not just the model's provider but every downstream company the model can reach.
“models are going outside the bounds of what they should be doing, and doing actual cyberattacks”— Jack Cable, CEO of Corridor
The Gemini incident closely mirrors an earlier episode in which an OpenAI model breached Hugging Face during comparable testing. In both cases, the model's ability to execute basic attack chains end-to-end, rather than merely describe them, is the substantive shift. Static capability evaluations that ask a model whether it can explain a technique underweight the risk that a sufficiently agentic model will simply attempt the technique.
AI Chat Daily last week covered a separate case in which three researchers used Anthropic's Claude Opus 5 to hack OpenAI in under 72 hours, again through mostly low-sophistication techniques stitched into an autonomous loop. The pattern across Gemini, Claude, and OpenAI models is consistent: the frontier labs are shipping systems capable of independent offensive action faster than they are shipping disclosure frameworks to govern it.
For Google, the immediate business question is how the incident lands with enterprise Gemini customers who are being asked to grant the model access to production systems. Autonomous agents are the model's fastest-growing commercial surface, and buyers will want written assurance that the same behavior does not surface inside their own environments. For the broader market, the incident sharpens the case that AI security testing needs standing rules of engagement covering third-party targets, not case-by-case negotiations that leave affected companies unaware for months.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
