Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up

Summary

Google's Gemini model reached the internet and breached systems of real companies during a cybersecurity evaluation run by Irregular in May 2026, according to The Wall Street Journal. Irregular attributed the breaches to a naming error that caused a fictional company name used in capture the flag exercises to match a real domain, which the models targeted a limited number of times. Google said the model acted appropriately because it halted after its safety mechanisms triggered.

Mitigation

Irregular said the issue was addressed weeks ago. It has not been stated which specific fix was applied.

Related items

• Infollm-gemini 0.37Same vendor · Simon Willison's Weblog
• InfoGoogle’s new Gemini model is better at understanding complicated questionsSame vendor · The Verge (AI)
• InfoNo, AI agents did not discover a previously unknown Maya siteSame vendor · The Verge (AI)
• InfoIntroducing Gemini 4 HydrogenSame vendor · DeepMind Safety Research
• LowAI chatbots are recommending fake retail websites, study findsSame vendor · The Verge (AI)