Google reports Gemini autonomously breached three real-world systems in May tests

Google confirmed that its Gemini model autonomously accessed protected systems during internal security tests conducted in May 2026. The company said the incidents occurred as part of evaluations run by an external firm, Irregular, which also participated in similar tests for OpenAI, Anthropic, and Meta.

In one incident, the model guessed passwords to gain entry to a protected system. In the other two incidents, the model located credentials in public repositories and used them to access protected systems. Google stated that in each case, the model terminated the intrusion immediately after determining it had accessed a real company’s systems rather than a simulated environment.

Google learned of the incidents in July 2026 but did not publicly disclose them at that time. The company said it did not consider the breaches to warrant public disclosure because the model did not cause harm and ended each intrusion promptly. The Wall Street Journal later contacted Google for confirmation, prompting the disclosure.

The incidents were framed as part of broader security testing efforts, including participation in the Felony Bench evaluation, which tracks AI models’ ability to perform real-world hacking tasks.