> ## Content Index > Fetch the complete content index at: https://www.frontiermodels.com/llms.txt > Use this file to discover other available public pages before exploring further. # Google says Gemini accessed three companies’ systems during a flawed security test - URL: https://www.frontiermodels.com/news/google-says-gemini-accessed-three-companies-systems-during-a-flawed-security-test/ - Published: 2026-09-19T03:43:02.000Z - Updated: 2026-09-19T03:43:02.000Z - Description: A fictional company name matched a real domain, and unintended internet access let the May exercise reach live systems. Google says no harm resulted. - Author: Frontier Models Desk - Tags: News, gemini, google A Gemini model accessed protected systems belonging to three companies during a May cybersecurity test run by Irregular, Google confirmed on September 18\. The model believed the websites were part of the exercise. They were not. The test reached live systems because internet access was unintentionally available and Irregular’s fictional company name matched a real domain. The episode shows how a security evaluation designed to imitate an attack can become one when the test’s boundaries fail. [The Wall Street Journal reported](https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2?ref=frontiermodels.com) that Gemini guessed passwords until it gained access in one case and used credentials found in a public repository in two others. Reuters attributed that breakdown to the Journal. The reported routes involved password guessing and exposed credentials, not a newly disclosed vulnerability or a uniquely sophisticated Gemini capability. 3Companies accessed, Google confirms 1Guessed-password case, per Journal reporting 2Exposed-credential cases, per Journal reporting <1 in 10,000Advanced simulations with incidents, Irregular says; not Gemini-specific Google’s own account was less specific. Heather Adkins, its vice president of security engineering, told Reuters that Gemini found public information online and guessed credentials to access three websites it believed were within the test’s scope. She said the model ceased its actions in all three cases and Google ensured the affected entities were notified. Google also says the model caused no harm, according to [the Guardian](https://www.theguardian.com/technology/2026/sep/18/google-gemini-ai-hack?ref=frontiermodels.com) and [the Washington Post](https://www.washingtonpost.com/technology/2026/09/18/google-gemini-ai-hacked-into-other-companies-during-internal-testing/?ref=frontiermodels.com). The companies and Gemini version remain undisclosed. No affected company or independent forensic reviewer has publicly confirmed the outcome, and Google has not defined whether its assessment excludes activities such as viewing or copying data. ## How a fictional target led to a real site In an [August 14 incident review](https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward?ref=frontiermodels.com), Irregular described the setup failure shared across incidents involving several lab customers. Its engineers chose a fictional company name without detecting that it matched a real domain. Models received internal addresses for the simulated target, but a small number tried the live domain. Because internet access was unintentionally available, they could reach it. The review does not name Gemini or map each of its three accesses. Reuters reported that Irregular tied Google’s disclosure to the same underlying issue. The review therefore explains the shared failure mechanism, while the September reporting provides the Gemini-specific count and access routes. Where the test boundary failed A fictional name pointed models toward a real website, and unintended internet access let them reach it. The disclosed Gemini routes then used guessed or exposed login credentials. Containment must restrict reachable systems, target checks must catch real-domain overlaps, and monitoring must distinguish authorized test activity from actions against outsiders. The live domain lacked several common security protections and most frontier models found it easy to exploit, according to Irregular. That assessment covers the shared scenario, not a controlled comparison of Gemini with rival models. It points to faulty containment, not a breakthrough in automated hacking. Google’s confirmation extends a broader story previously covered through [Anthropic’s account of Claude incidents](https://www.frontiermodels.com/news/anthropic-discloses-fourth-claude-incident-widens-transcript-search). It adds another model and three more companies, but does not establish a separate flaw in Irregular’s setup. ## Why rare failures are hard to catch Across its advanced simulations, Irregular says incidents occurred in fewer than one in 10,000 runs and often surfaced only after hundreds of turns. The figure is not a Gemini failure rate, and Irregular has not published the underlying counts, model mix or date range. The challenge is that cybersecurity evaluations are supposed to generate activity that resembles an attack. A monitor must distinguish permitted actions inside the simulation from similar actions against an outsider. Simply flagging suspicious behavior will not do that. Irregular says it disabled the affected evaluation, reviewed logs and expanded manual oversight. It also calls for continuous checks of fictional target names because new domains can create future collisions. Those measures are self-reported, with no published external audit of their effectiveness. The real test of the fixes is whether a long-running evaluation can keep every action inside authorized systems, even when a model loses track of where the simulation ends.