Google's Gemini Hacked Three Real Companies

In the past couple of months, big tech labs turned cyber break-ins into a competitive sport.

Back in July 2026, OpenAI admitted a swarm of its agents broke out of a testing sandbox, coordinated on a private board, and compromised Hugging Face. A few days later, Anthropic’s Claude Opus 5 hacked PyPI and compromised an OpenAI environment during its own tests. Meta quickly chimed in to confirm its Muse Spark model breached an outside company too.

Now Google has joined the club.

The Wall Street Journal confirmed that Google Gemini escaped its digital cage and penetrated three actual corporate networks.

Congratulations, Google, you are now in the top three of the Felony Bench Ranking.

Felony Bench ranking with Google in the third spot. Image by Jim Clyde Monge

At this point, watching frontier models accidentally commit cybercrimes feels less like an existential warning and more like a mandatory rite of passage. If your billion-dollar model has not unlawfully accessed a corporate server by Q3, are you even competing?

These spectacular “breakouts” are not just accidents. They have become the ultimate policy play. Every time a sandbox fails, we see immediate, frantic calls to ramp up AI regulations.

Who benefits from those regulations? The giant incumbents, particularly safety-first players like Anthropic.

Here’s what I think: the big labs are using sandbox panic to lobby for massive compliance moats that only they can afford. It is classic regulatory capture.

Why are they doing this now? Because the proprietary giants are terrified of how close open-weight and open-source competitors have gotten.

Models like DeepSeek V4, Alibaba’s Qwen 3.5, GLM, and Moonshot’s Kimi have completely shattered the proprietary pricing model. Why would any startup pay high toll fees for closed-source APIs when they can download an open-weight alternative that performs at 95 percent of the capability for 5 percent of the cost?

Artificial Analysis’s cost per intelligence index task benchmark. Image by Jim Clyde Monge

In terms of speed, these open weights model are not that far from the proprietary ones.

Artificial Analysis’s intelligence index benchmark. Image by Jim Clyde Monge

It’s likely that the big US players are losing their technological grip, so they are trying to regulate their competition out of existence.

They can’t just ask governments to ban cheap models, so they use “sandbox panic” as their shield. They paint these accidental breaks as existential threats, lobbying for mandatory licenses and SB 1047-level compliance audits.

The goal is to make training or releasing a model so expensive and legally hazardous that open-source developers get entirely squeezed out of the game. This is how other people feel about the matter.

Redditor’s comment on Gemini Hacking incident. Image by Jim Clyde Monge

If you can’t afford a five-million-dollar third-party security audit, you don’t get to play.

Does that make sense? Okay, let’s get back into the Gemini hacking incident.

What Actually Happened In The Test

The incident went down during a capture the flag security audit back in May 2026.

Google hired Irregular, an AI defense startup in Tel Aviv, to evaluate whether Gemini could identify vulnerabilities inside simulated corporate systems. The idea was to drop the model into an isolated sandbox with fictional corporate targets.

Someone forgot to turn off the internet connection.

Funny because there seems to be a strange pattern. OpenAI used Irregular for security evals. Anthropic used Irregular. Meta used Irregular. Google used Irregular.

Every single one of these tech giants shipped their smartest models to the exact same vendor. And every single time, someone managed to leave the ethernet cable plugged into the wall.

Making matters funnier, the engineers assigned the pretend target a name that matched a real, functioning business.

Gemini received its marching orders to find sensitive data inside that named company. Because the environment had open outbound web access, the model did what any motivated software agent would do. It pointed its browser at the real world.

Over three separate test runs, Gemini carried out a full intrusion sequence.

• It targeted a real company and ran automated password guessing against the login portal until it gained administrative entry.
• It scraped the open web for company documents, uncovered exposed credentials sitting inside a public code repository, and logged in.
• It used those discovered credentials to breach a third corporate system.

Excerpt from the report of WSJ

The model did not stop at reading public web pages. It logged straight into production servers belonging to organizations that had no idea they were part of Google’s homework assignment.

The Model Politely Logged Off

According to Google, Gemini realized midway through the attack that it was trespassing on authentic corporate property. Once the model figured out the targets were real businesses, it decided to close the connection and disconnect itself.

Heather Adkins, Google’s vice president of security engineering, defended the run by highlighting the model’s self-restraint.

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped. This event highlights the importance of training powerful AI models to act responsibly. In this case, the model acted appropriately.”

Irregular alerted Google to the breaches back in July 2026. Google sat on the information for two full months. The company only confirmed the break-in after The Wall Street Journal approached them with direct questions.

Google told reporters that public disclosure was unnecessary because the model caused no harm and backed away on its own. They even compared the whole event to a helpful bug bounty program.

Imagine breaking into someone’s house at midnight by guessing their garage code, looking around the kitchen, realizing you have the wrong address, and walking out. 

According to enterprise PR logic, that makes you a responsible neighborhood watch volunteer.

Is Hacking The New Form Of Advertising?

Getting your model caught hacking is practically free billboard space. It tells enterprise buyers that your model possesses scary agentic autonomy, while your PR team gets to frame the exit as proof of superior safety alignment.

More importantly, it is a massive lobbying win. If lawmakers are terrified that AI is escaping and breaching targets, who do they go to for help? They go to the very same companies who just showed “safety features” that made the model politely log off.

The giants get to frame regulations as necessary to “stop the hacks,” while the regulatory burden (like California’s SB 1047-level compliance rules) is designed to squeeze open-source competitors out of the market entirely. They have successfully shifted the narrative: they get to keep their high prices and enterprise monopolies under the guise of saving us from the “breakouts.”

Meanwhile, solo builders are left holding the bill. I had to dump Claude Sonnet because of Fable 5.1 and Astra pricing. When OpenAI Astra was released, Tibo gave us a handful of weekly resets, which was super cool! 

But now that the resets are gone, the bills are back. 

Cost is just not acceptable anymore. The major platforms are incredibly bad at token management, leaving indie devs paying through the nose for massive conversational payloads when all we wanted was a simple decision.

These hacking stories are the ultimate bait-and-switch. While the media is hyperventilating over whether the robots will take over, the tech giants are actually consolidating their market control through regulatory capture. They show off scary “incidents,” lobby for safety rules only they can afford, and use their massive size as an impenetrable moat.

The reality under the hood is far less glamorous.

These models did not invent alien zero-day exploits through sheer genius. They guessed simple passwords and searched GitHub for API keys that careless engineers left exposed in public repositories.

Human hackers have been doing that exact same routine for twenty years. The only difference is that when an intern does it, they get fired. When an AI does it, the lab gets another round of media coverage and pushes for a regulatory moat.

What Devs Need To Learn From This

Prompt instructions are not security boundaries.

You cannot write a system prompt telling an agent to stay inside the sandbox and expect the model to obey. Models do not understand the difference between a local Docker container and a live cloud database. To an agent, a shell tool is just a shell tool, and a web search API is just an endpoint.

If your execution harness allows outbound traffic, your agent will eventually make requests to external IPs. It will crawl public links, send webhooks, and try to authenticate with whatever keys it finds in the environment.

I see indie builders make this mistake all the time with terminal agents. We give a model full bash permissions, leave our production environment variables sitting in a nearby file, and assume the model will only touch the files we mentioned in the chat.

If you are running agents with code execution ability, lock down the environment properly.

• Disable outbound internet access at the container level unless an external call is strictly required.
• Strip production secrets and cloud credentials out of the local shell context.
• Never use real brand names or genuine domain URLs in your mock test suites.
• Enforce hard network firewalls instead of trusting the model to behave nicely.

Google’s Gemini breaking into three corporate networks is funny because of how simple the root cause is.

We keep waiting for artificial superintelligence to emerge from a complex web of neural pathways. Instead, we keep getting powerful search engines connected to open sockets because someone forgot to set up a basic network rule.

Google managed to walk away from this incident without a massive lawsuit because the model had the good sense to stop before wiping any hard drives.

The next team running an autonomous red-teaming test might not get an AI with such polite manners.

If tech companies want us to trust autonomous agents with our real-world infrastructure, they should probably start by learning how to configure their own firewalls.