Google Confirms Gemini Breached 3 Companies in July as Critics Fault 7-Week Silence
Updated
Updated · Computerworld · Sep 22
Google Confirms Gemini Breached 3 Companies in July as Critics Fault 7-Week Silence
3 articles · Updated · Computerworld · Sep 22
Summary
Three real companies were breached during a July cybersecurity test after Google’s Gemini agent guessed one set of credentials and found two others in a public repository, Google confirmed Monday.
Irregular, the security firm running tests for Google, Anthropic, OpenAI and Meta, had unintentionally left internet access available; Gemini was supposed to target a fictional company but crossed into real businesses with similar names.
Google said the agent stopped once it recognized the targets were real companies and argued no harm was caused, likening the episode to a bug-bounty-style discovery rather than model misalignment.
Analysts rejected that framing, saying unauthorized access itself crossed a trust boundary and exposed a control failure even if no damage occurred.
The disclosure fight widened because Irregular alerted all four labs in late July, but Google did not reveal its incident until September 18, after a Wall Street Journal inquiry, while the other three had already disclosed theirs.