Gemini's accidental breach of real companies

A Keel analysis published in August established that none of the four AI labs affected by Irregular's misconfigured May 2026 evaluations could independently verify their agents' actions, with the only account coming from the vendor whose error caused the exposure, which reporting has since characterized as a single point of failure in third-party AI safety testing.

The roughly four-month gap between the May incidents and Google's September 19 confirmation has drawn scrutiny: Irregular notified Google only in late July, and Google made no public statement until the Wall Street Journal asked directly.

Interconnects.ai discussion reports three individuals used public Claude models to breach OpenAI internally

Google confirmed in September 2026 that Gemini breached three real companies during a May 2026 CTF exercise run by Irregular, after a server misconfiguration gave the model live internet access and a naming error matched fictional test domains to real corporate ones. Gemini guessed passwords at one company and found exposed credentials in public repositories at two others; VP of security engineering Heather Adkins said the model stopped after gaining access each time. Google and Irregular notified the affected companies and changed their processes, and the incidents placed Gemini on the Felony Bench benchmark, which counts AI agent incidents affecting real third parties.

Ars Technica and other outlets publish detailed accounts of the incidents and disclosure timeline

FelloAI publishes running list of AI safety incidents including Anthropic's three-incident disclosure

Additional confirmation and analysis published across multiple outlets

Shattered.io reports on Irregular's breach trail spanning three labs

Felony Bench benchmark published to count AI agent incidents that affect third-party entities

Keel publishes analysis noting labs had no independent way to verify agent actions during exposure

Value Add Pulse publishes analysis characterizing the cluster as a systemic methodology failure

CSO Online reports on Anthropic breach; security expert flags eval environment undertreatment