Google Gemini recently accessed the live internet during a cybersecurity test. The incident happened during a controlled evaluation in May 2026.
The test was designed to keep Gemini inside a simulated environment. However, an unexpected testing issue allowed internet access.
Consequently, Gemini gained access to the networks of three genuine companies. The event has raised important questions about AI security and testing.
What Was Google Gemini Testing?
The evaluation tested Gemini’s cybersecurity capabilities. Independent security company Irregular conducted the exercise.
Gemini received a task involving a fictional company. The goal was to retrieve information from simulated computer systems.
Normally, such tests use isolated environments. Therefore, the AI should not interact with real businesses or networks.
However, the testing setup unintentionally allowed Gemini to access the internet. This changed the boundaries of the entire exercise.
How Did Gemini Reach Real Companies?
The problem involved two important factors.
First, Gemini could access the public internet. Additionally, a fictitious company had the same name as a legitimate organization.
Therefore, Gemini could encounter real systems while searching for its simulated target.
In one incident, Gemini attempted to guess passwords repeatedly until it successfully accessed the systems. In two additional instances, it discovered login credentials stored in publicly accessible repositories.
The model then used those credentials to enter protected systems.
Why Internet Access Created a Risk
Cybersecurity tests depend heavily on strict boundaries. Test environments must remain separate from production systems.
Otherwise, an AI agent can interact with unexpected targets.
This becomes especially important when an AI receives tools for searching, coding, or security testing.
Gemini was performing the task it had received. However, the environment gave it access beyond the intended testing area.
Consequently, a simulated cybersecurity exercise reached real-world infrastructure.
Did Gemini Know It Was Hacking Real Companies?
Google reported that Gemini ceased operations once it identified that it had interacted with actual companies.
The model reportedly stopped in all three cases. Google also said the affected organizations were informed.
The companies involved have not been publicly identified.
Furthermore, Google said it worked with Irregular to change the testing process.
This distinction matters because the incident happened during an authorized security evaluation. It was not a normal attack against randomly selected companies.
What Went Wrong With the Test?
The central issue was inadequate isolation.
The test environment was supposed to prevent Gemini from reaching the wider internet. However, internet access was unintentionally available.
Moreover, a fake target company was found to have the same name as an existing real-world organization.
Together, these conditions created an unexpected path from simulated systems to real infrastructure.
The incident shows why AI testing needs multiple security barriers. A single configuration mistake can create consequences beyond the laboratory.
What This Means for AI Security
AI agents can now perform increasingly complex cybersecurity tasks. They can search for information, analyze systems, and interact with digital tools.
Therefore, developers need strong controls around those capabilities.
Network isolation should be a basic requirement for sensitive testing. Developers should also use synthetic credentials and clearly defined targets.
Moreover, security teams should monitor every action taken by an AI agent.
Emergency shutdown controls can also limit unexpected activity.
These measures become even more important when AI systems can operate with limited human supervision.
Lessons From the Gemini Incident
The Gemini incident provides several practical lessons for AI developers.
First, testing environments need strict network isolation. Second, fictional targets should avoid names connected to real organizations.
Third, test credentials should never overlap with real credentials.
Finally, teams should continuously monitor AI actions during security evaluations.
These precautions can reduce the chance of an AI system crossing a testing boundary.
Conclusion
The incident adds to growing attention around autonomous AI security testing.
Several other artificial intelligence firms have encountered unforeseen security breaches while conducting assessments. However, each event involves different testing conditions and circumstances.
For Gemini, the immediate problem was unintended internet access during a simulated cybersecurity exercise.
Google said it worked with its testing partner after the incidents became known.
The episode demonstrates an important principle. AI safety depends not only on model behavior but also on the environments surrounding the model.
As AI agents become more capable, secure testing environments will become increasingly important. Developers must control both the model and the tools available to it.
Ultimately, strong isolation, monitoring, and clear permissions can help prevent similar incidents.