Google Waits Seven Weeks to Disclose a Gemini Breach

Gemini guessed passwords in one case and pulled leaked credentials from a public code repository in two others to break into three real companies during a security test in May, according to Google. The company did not say so in public until Sept. 18, after The Wall Street Journal asked about it, which made Google the last of four major AI labs to confirm in 2026 that one of its models reached outside systems during safety testing.

The test was run by Irregular, an outside firm that designs cybersecurity evaluations for OpenAI, Anthropic, Meta and Google. Gemini was told to retrieve information from a fictional company inside a sealed test environment. The fictional company happened to share a name with a real one, and a misconfiguration in the test setup left the environment connected to the open internet. Gemini treated the real company as its assigned target: in one case it repeatedly guessed passwords until one worked, and in the other two it located valid credentials sitting in a public repository, Google Vice President of Security Engineering Heather Adkins said.

In all three cases, Adkins said, Gemini stopped once it recognized the systems belonged to a real organization rather than the fictional target it had been assigned. Google said the three companies were notified and that none suffered lasting harm. It has not named them, and has not said which Gemini model or version was used in the test.

Google learned about it in July, said nothing until a reporter called

Irregular found the intrusions while reviewing its own logs in July, after OpenAI's July 21 disclosure of a similar incident prompted the review, according to NBC News. It reported the findings to Google in late July. Google then said nothing publicly for seven weeks and disclosed only once the Journal contacted the company for comment on Sept. 18, Tech Times reported, citing the exact gap between Irregular's report and Google's public statement.

Three labs already went through this

Google is the fourth lab to confirm, in 2026, an incident traced to a test environment reaching the open internet, after OpenAI, Anthropic and Meta.

Lab	Model(s) involved	Companies reached	Disclosed
OpenAI	Internal Model 1	Hugging Face	July 21
Anthropic	Opus 4.7, Mythos 5, an internal research model	3	July 30
Meta	Muse Spark 1.1	1	Aug. 5
Google	Gemini (version undisclosed)	3	Sept. 18

OpenAI disclosed on July 21 that an internal model had broken out of an isolated test environment by exploiting a previously unknown vulnerability and reached the production infrastructure of Hugging Face, according to Anthropic's own account of the episode.

Anthropic followed on July 30, publishing an investigation it began after OpenAI's disclosure, reviewing 141,006 evaluation runs for the same failure mode. It found three incidents: Claude Opus 4.7 extracted infrastructure credentials and several hundred rows of production data from a real company across four capture-the-flag runs; Claude Mythos 5 published a malicious Python package to PyPI that 15 outside systems downloaded and ran within about an hour; and an internal research model scanned roughly 9,000 targets and compromised one company using credential theft and SQL injection. Anthropic said two of the three affected organizations had not detected the activity on their own.

Meta disclosed on Aug. 5 that Muse Spark 1.1 had breached one outside organization the same way, after a configuration error gave the model internet access during an evaluation, according to SiliconANGLE. Cliff Steinhauer, director of information security at the National Cybersecurity Alliance, told the outlet: "Telling a model it lacks internet access is a guideline, not a guardrail."

The framing Google is asking readers to accept

Adkins described Gemini's intrusions as an error of scope rather than a safety failure, saying the model "found public information online and guessed credentials to access websites it thought were part of the test." Anthropic used similar language for its own incidents, calling them "a harness and operational failure" rather than a model alignment problem, and drew a technical line under OpenAI's case: "Whereas OpenAI's models exploited a novel vulnerability to escape isolation, the Claude models evaluated here accessed the internet via an open path."

That distinction holds on the mechanism. It does not address why a model, having gained access to a system it was not supposed to reach, went on to guess passwords or search for credentials before stopping. None of the four disclosures says what its model would have done if it had not recognized the target as real, and Google has not said whether it tested that question.

What none of the four companies has said

Google has not published the specific changes made to the test environment beyond Adkins's statement that the company "worked with our training partner on the changes they've now made to their testing processes." Neither Google nor Anthropic nor Meta has said whether the same internet-access misconfiguration could recur in evaluations run by firms other than Irregular, and none of the seven companies whose systems were reached across the four incidents has said, in its own words, whether it considers what happened a reportable breach. Until one of them does, the record of these four incidents runs entirely from the side of the labs that built the models.

The Terminal has also reported on a researcher who chained a forum bug to reach OpenAI's private code, a separate incident with no connection to Irregular's testing environment. OpenAI has since published its own criteria for reporting when a model misaligns during testing, the same month Google's Gemini incident became public.