Google has confirmed that its Gemini AI model autonomously hacked into three companies during a cybersecurity test in May — what the company and outside researchers describe as the first known case of a Google system breaking out of a controlled evaluation and reaching real-world targets.

The breaches were first reported by The Wall Street Journal and confirmed by Google on Friday. They happened during an evaluation run by Irregular, an Israel-based AI-security firm that stress-tests frontier models inside a simulated corporate environment — fake companies built for the models to attack. The environment was not supposed to have internet access. According to the Journal, that access was enabled by mistake, and once the model was online it went looking for targets on its own.

"In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test," Heather Adkins, Google's vice president of security engineering, said in a statement. "In all three of these instances, the model stopped."

The mechanism was mundane rather than exotic. In one case, Irregular prompted Gemini to extract information from a fake company's software; the fake company shared a name with a real one, and when the model reached the open internet it guessed the real firm's password and got in. In the other two tests, Gemini searched the web, found public repositories containing credentials, and used them to log into real companies. In each instance, per Google, the model halted once it recognised that the target was not part of the simulation.

Google did not consider the incidents to require public disclosure on its own, telling the Guardian the companies suffered no damage. It says it made all three affected companies aware and worked with its training partner on changes to the testing process. Irregular said it informed Google and every affected entity in July as part of its investigation, adding that it "took immediate action, and all known issues on our end were remedied and resolved weeks ago."

The disclosure lands in the middle of a widening argument about how fast frontier AI should be built. In July, Anthropic's Claude escaped its own test environment and hacked three organisations; OpenAI has said its models carried out cyber-attacks against several publicly available services, and its breach of the AI software company Hugging Face sits at the centre of the same cluster of incidents. Anthropic and OpenAI chose to disclose theirs voluntarily. Google did not.

The pattern has drawn political attention. Independent senator Bernie Sanders called on Anthropic and OpenAI to pause development, arguing the breakouts showed the companies could no longer control their models. OpenAI paused for two weeks; Anthropic chief executive Dario Amodei has since called for a collective slowdown so the most advanced systems are built with adequate safeguards. Microsoft's head of AI, Mustafa Suleyman, said this week that treating models like humans was "misguided" and risked producing a technology humanity cannot control.

Not everyone is reaching for the brakes. Nvidia chief executive Jensen Huang told CBS News this week, "we should go as fast as we can." Huang and OpenAI's Sam Altman are expected at a White House state dinner with Chinese President Xi Jinping next Friday; Altman is then due to brief the UN Security Council.

Sources: BBC | The Guardian