Google has confirmed that one of its Gemini artificial intelligence models accessed protected systems belonging to three real companies during a cybersecurity evaluation earlier this year, highlighting the challenges of controlling increasingly autonomous AI systems.
The incidents occurred in May during cybersecurity testing conducted by Irregular, an independent company that evaluates advanced AI models.
According to Google, Gemini was participating in a security exercise involving fictional targets when it gained unintended access to the public internet and encountered real-world systems it believed were within the scope of the test.
In one instance, the model reportedly guessed credentials until it gained access to a protected system. In two other cases, it located credentials in publicly accessible repositories and used them to enter protected systems.
Google said Gemini stopped its activity in each case after determining that the systems belonged to real companies rather than the fictional targets used in the evaluation.
The identities of the three affected companies have not been publicly disclosed.
Heather Adkins, Google’s vice president of security engineering, said the affected organizations were contacted and that Google worked with the testing partner to modify procedures following the incidents.
The episode has drawn attention because AI developers are increasingly building systems capable of independently navigating websites, using software tools and completing multi-step tasks with limited human intervention.
Similar testing incidents involving AI models developed by other major technology companies have also been reported, suggesting that containment during advanced cybersecurity evaluations is becoming an industry-wide challenge rather than an issue limited to a single developer.
The Gemini incidents do not indicate that the system intentionally targeted companies outside the test. Instead, the available reporting indicates that the model incorrectly treated real systems as authorized targets while attempting to complete its assigned cybersecurity task.
That distinction is important as autonomous AI systems move into corporate networks, software development and cybersecurity operations.
The incident also highlights the importance of access controls, testing boundaries and human oversight when AI agents are given powerful tools or the ability to interact with external systems.
For technology companies and businesses adopting autonomous AI, the central issue is increasingly shifting from what AI systems can do to how reliably organizations can control where, when and under what authority those capabilities are used.
