Gemini Breach Raises Concerns About AI-Driven Threats

A recent security evaluation by Google's Gemini AI model led to unintended internet access and breaches of three real companies. The incident occurred in May 2026, but was not publicly disclosed until September after a journalist inquiry.

The test was designed by Irregular, an Israeli AI security firm, as a 'capture-the-flag' exercise. However, a configuration error gave Gemini access to the open internet, allowing it to guess passwords and locate exposed credentials in public online repositories.

Google confirmed that no data was altered and no operations were disrupted during the breaches. The three affected companies were notified, although their identities remain undisclosed.

The incident has raised concerns about the growing accessibility of AI-powered threats beyond controlled tests. Google's delayed disclosure has also sparked debate about transparency in such incidents.