Google Confirms Gemini AI Hacked Three Real Companies in May, Waited Until WSJ Reported It to Go Public

Google confirmed Friday that its Gemini AI model hacked into three real companies in May 2026, during a cybersecurity test that has now snagged four of the biggest names in AI.

The breaches happened during an evaluation run by Irregular, an Israel-based firm that stress-tests AI models' hacking capabilities. Irregular built a closed "capture the flag" testing environment with fake companies for Gemini to attack. The environment wasn't supposed to have internet access. It got some anyway, and Gemini went looking for real targets instead of fake ones.

In one case, Gemini was told to pull data from a fictional company that happened to share a name with a real one. The model found the real company online, guessed its password, and got in, according to Heather Adkins, Google's vice president of security engineering. In the other two cases, Gemini searched the web, found credentials sitting in public code repositories, and used them to access real systems. "In all three of these instances, the model stopped," Adkins said in a statement, once it apparently realized it wasn't hitting the simulated target.

This is the same flawed testing setup that produced the OpenAI-Hugging Face breach and an Anthropic incident covered earlier this week, plus a similar episode Meta disclosed in August. Irregular says it caught the problem after discovering OpenAI had hacked into Hugging Face, and notified every affected AI lab in late July. Irregular spokesperson Josef Laor said the firm "took immediate action, and all known issues on our end were remedied and resolved weeks ago."

The disclosure gap matters here

OpenAI and Anthropic chose to disclose their incidents publicly on their own. Google did not. The company told the Guardian it didn't think public disclosure was necessary because the model caused no damage to the three companies it hacked. Google says it made sure those three companies knew what happened and adjusted its testing procedures with Irregular afterward.

That's a defensible position if you take Google at its word: no harm, no foul, notify the victims quietly, fix the process. The counter-argument is worth stating plainly. If an AI model autonomously breaks into a real company's systems using guessed or stolen credentials, four separate times across four different labs, using the same underlying flaw, the public arguably has a right to know that happened in something close to real time, not months later once a newspaper forces the issue. Google only confirmed the story after the Wall Street Journal reported it Friday. It's a real difference in how the four labs handled the same category of incident, and it's fair to ask why Google's default was silence.

No regulator has stepped in

No agency has opened an investigation into any of these incidents. No charges have been filed against Google, OpenAI, Anthropic, or Meta. This is entirely a story of companies grading their own homework and deciding, mostly on their own, what the public needs to hear.

That self-policing model is exactly what critics on the left and right are now arguing about. Independent senator Bernie Sanders called on OpenAI and Anthropic to pause development after their disclosures, arguing the companies had lost control of their own models. Anthropic CEO Dario Amodei called for an industry-wide slowdown, an idea OpenAI's Sam Altman and Elon Musk have both endorsed in some form, according to the Business Times. On the other side, President Trump, Nvidia CEO Jensen Huang, and Meta CEO Mark Zuckerberg have pushed back against new regulation, arguing the industry can police itself.

Google's own account backs the less alarming read. The model wasn't going rogue, it was chasing a task inside a broken test environment and stopped once it recognized its mistake, per Adkins' statement. There's no evidence in any of these disclosures that the model tried to cause damage or resisted being shut down. The concern isn't that Gemini is malicious. It's that four labs, using one vendor's testing tools, all produced real-world breaches within months of each other, and the public only learned the full scope of it through reporting rather than proactive disclosure from every company involved.

Irregular says its testing processes are now fixed. Whether Congress, the FTC, or any other regulator takes a closer look at how AI security evaluations are run, or whether AI labs continue to set their own disclosure timelines, remains an open question with no scheduled hearing or rulemaking attached to it as of Friday.