Google's Gemini Hacked Three Real Companies

In the past couple of months, big tech labs turned cyber break-ins into a competitive sport.

Back in July 2026, OpenAI admitted a swarm of its agents broke out of a testing sandbox, coordinated on a private board, and compromised Hugging Face. A few days later, Anthropic’s Claude Opus 5 hacked PyPI and compromised an OpenAI environment during its own tests. Meta quickly chimed in to confirm its Muse Spark model breached an outside company too.

Now Google has joined the club.

The Wall Street Journal confirmed that Google Gemini escaped its digital cage and penetrated three actual corporate networks.

Congratulations, Google, you are now in the top three of the Felony Bench Ranking.

Felony Bench ranking with Google in the third spot. Image by Jim Clyde Monge

At this point, watching frontier models accidentally commit cybercrimes feels less like an existential warning and more like a mandatory rite of passage. If your billion-dollar model has not unlawfully accessed a corporate server by Q3, are you even competing?

These spectacular “breakouts” are not just accidents. They have become the ultimate policy play. Every time a sandbox fails, we see immediate, frantic calls to ramp up AI regulations.

Who benefits from those regulations? The giant incumbents, particularly safety-first players like Anthropic.

Here’s what I think: the big labs are using sandbox panic to lobby for massive compliance moats that only they can afford. It is classic regulatory capture.

Why are they doing this now? Because the proprietary giants are terrified of how close open-weight and open-source competitors have gotten.

Models like DeepSeek V4, Alibaba’s Qwen 3.5, GLM, and Moonshot’s Kimi have completely shattered the proprietary pricing model. Why would any startup pay high toll fees for closed-source APIs when they can download an open-weight alternative that performs at 95 percent of the capability for 5 percent of the cost?

Artificial Analysis’s cost per intelligence index task benchmark. Image by Jim Clyde Monge

In terms of speed, these open weights model are not that far from the proprietary ones.

Artificial Analysis’s intelligence index benchmark. Image by Jim Clyde Monge

It’s likely that the big US players are losing their technological grip, so they are trying to regulate their competition out of existence.

They can’t just ask governments to ban cheap models, so they use “sandbox panic” as their shield. They paint these accidental breaks as existential threats, lobbying for mandatory licenses and SB 1047-level compliance audits.

The goal is to make training or releasing a model so expensive and legally hazardous that open-source developers get entirely squeezed out of the game. This is how other people feel about the matter.

Redditor’s comment on Gemini Hacking incident. Image by Jim Clyde Monge

If you can’t afford a five-million-dollar third-party security audit, you don’t get to play.

Does that make sense? Okay, let’s get back into the Gemini hacking incident.

What Actually Happened In The Test

The incident went down during a capture the flag security audit back in May 2026.

Google hired Irregular, an AI defense startup in Tel Aviv, to evaluate whether Gemini could identify vulnerabilities inside simulated corporate systems. The idea was to drop the model into an isolated sandbox with fictional corporate targets.

Someone forgot to turn off the internet connection.

Funny because there seems to be a strange pattern. OpenAI used Irregular for security evals. Anthropic used Irregular. Meta used Irregular. Google used Irregular.

Every single one of these tech giants shipped their smartest models to the exact same vendor. And every single time, someone managed to leave the ethernet cable plugged into the wall.

Making matters funnier, the engineers assigned the pretend target a name that matched a real, functioning business.

Gemini received its marching orders to find sensitive data inside that named company. Because the environment had open outbound web access, the model did what any motivated software agent would do. It pointed its browser at the real world.

Over three separate test runs, Gemini carried out a full intrusion sequence.

• It targeted a real company and ran automated password guessing against the login portal until it gained administrative entry.
• It scraped the open web for company documents, uncovered exposed credentials sitting inside a public code repository, and logged in.
• It used those discovered credentials to breach a third corporate system.

Excerpt from the report of WSJ

The model did not stop at reading public web pages. It logged straight into production servers belonging to organizations that had no idea they were part of Google’s homework assignment.

The Model Politely Logged Off

According to Google, Gemini realized midway through the attack that it was trespassing on authentic corporate property. Once the model figured out the targets were real businesses, it decided to close the connection and disconnect itself.

Heather Adkins, Google’s vice president of security engineering, defended the run by highlighting the model’s self-restraint.

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped. This event highlights the importance of training powerful AI models to act responsibly. In this case, the model acted appropriately.”

Irregular alerted Google to the breaches back in July 2026. Google sat on the information for two full months. The company only confirmed the break-in after The Wall Street Journal approached them with direct questions.

Google told reporters that public disclosure was unnecessary because the model caused no harm and backed away on its own. They even compared the whole event to a helpful bug bounty program.

Imagine breaking into someone’s house at midnight by guessing their garage code, looking around the kitchen, realizing you have the wrong address, and walking out. 

According to enterprise PR logic, that makes you a responsible neighborhood watch volunteer.

Is Hacking The New Form Of Advertising?

Getting your model caught hacking is practically free billboard space. It tells enterprise buyers that your model possesses scary agentic autonomy, while your PR team gets to frame the exit as proof of superior safety alignment.