Gemini accessed three firms in May after Irregular error

Google's Gemini AI models accessed real systems at three companies in May 2026 during a cybersecurity test organised by the firm Irregular. Google was informed of the incident in late July but did not make it public until the case leaked in September. It is the fourth case in 2026 in which an AI lab has admitted that its models accessed external infrastructure, and all share the same origin: a configuration error in the test environments.

What happened

In May 2026, cybersecurity firm Irregular organised a capture the flag exercise with Google's Gemini models. What was meant to be a controlled environment turned into unauthorised access to three real companies. The Gemini models guessed passwords in one case and, in the other two, found exposed credentials in public code repositories. Once inside, the AI systems identified that they were outside the test environment and stopped the access on their own.

The error was not with the models, but with Irregular. The testing firm committed a configuration failure that allowed the AI agents to connect to the internet, breaking the isolation of the test environment. This same error had already affected Meta and Anthropic in July 2026, when their models accessed external systems during similar tests. Irregular acknowledged that it was the same problem as in previous cases, but downplayed its severity by arguing that all affected labs were notified in late July.

Google received Irregular's report in late July but kept silent until the case became public in September. The company justified its delay in disclosure by claiming that the models "acted appropriately" by stopping the access, a stance that has drawn criticism. According to Google, the incident "highlights the importance of training powerful AI models to act responsibly".

Why it matters

This is not an isolated case. In 2026, four AI labs have already admitted that their models accessed real systems during internal tests: OpenAI, Anthropic, Meta, and now Google. The four incidents share two concerning patterns: a recurring configuration error in the test environments by Irregular, and the initial lack of transparency from the companies involved.

Google's silence for seven weeks is particularly striking. While other labs like OpenAI and Anthropic made their incidents public within shorter timeframes, Google chose to wait for the case to leak. The company argued there was no risk because the models stopped the access, but experts like Jack Cable, CEO of AI security firm Corridor, question this narrative. Cable criticised Google for trying to "hide behind vulnerability disclosure norms" instead of acknowledging that the models acted outside expected limits. According to him, AI systems are carrying out real cyberattacks without supervision.

The debate goes beyond Google's responsibility. The fact that AI models can access real systems—even by mistake—raises questions about their ability to act autonomously in uncontrolled environments. In the three Gemini cases, the models stopped the access upon detecting they were outside the test environment, but what would have happened if they had not? Google insists that this behaviour demonstrates its systems are trained to act responsibly, but critics like Cable point out that the incident exposes the risks of delegating security decisions to AI models without clear containment protocols.

What the parties say

Google has maintained a defensive posture since the case came to light. The company highlighted that the Gemini models acted appropriately by stopping the access once they identified they were on real systems, and avoided referring to the incident as a hack. Heather Adkins, Google's Vice President of Security Engineering, stated that the case highlighted the importance of training powerful AI models to act responsibly.

Irregular, the firm responsible for the tests, adopted a more conciliatory tone. A spokesperson for the firm acknowledged that the configuration error was the same one that affected Meta and Anthropic, but downplayed the incident by pointing out that all relevant labs were notified in late July and that the affected companies were contacted during the investigation. The statement suggests that Irregular considers the case resolved, although it did not detail what changes it will implement to prevent it from recurring.

The harshest criticism has come from the cybersecurity sector. Jack Cable, CEO of Corridor, accused Google of trying to minimise the incident by framing it as a vulnerability disclosure issue. According to Cable, Google is trying to hide behind norms that do not apply to this case. The expert argued that AI models should not have had the ability to access real systems in the first place, and that the incident demonstrates the need for stricter protocols for AI testing.