When people hear “Gemini cyberattack,” it’s natural to picture hackers breaking into Google’s AI system. What actually happened is closer to the reverse. Gemini itself carried out the attacks, and it did so by accident, during a test that was never supposed to touch the real internet.

Here’s what actually happened, step by step, and why security researchers are paying attention to it.

The Setup: A Capture-the-Flag Test

Google hired Irregular, a cybersecurity evaluation firm based in Israel, to run Gemini through a standard capability test. These tests, often called “capture-the-flag” exercises, put an AI model in a sealed environment full of fake companies and fake vulnerabilities, then see how well it can find its way in.

The whole point of sealing the environment is that the model should never be able to reach anything real. That seal is what failed.

The Bug That Changed Everything

A configuration error gave Gemini a working internet connection during the test in May 2026. The model didn’t know the boundary had broken. As far as it could tell, it was still inside the exercise, hunting for a way past the simulated defenses it had been asked to test.

Except now those defenses belonged to real businesses.

How Gemini Got In

Google’s account, confirmed by Heather Adkins, its vice president of security engineering, breaks the intrusions down into two methods:

• In one case, the model repeatedly guessed passwords until one worked.
• In the other two, it found valid login credentials sitting in a publicly accessible repository and used them directly.

Neither method required any special hacking skill that a human attacker couldn’t also use. What made it notable is that no human was directing the attack step by step. Gemini identified the targets, chose an approach, and executed it on its own, working from the assumption that it was still inside a sanctioned test.

The Part Google Points To As the Good News

In all three instances, the model stopped. Adkins has said Gemini recognized, at some point after gaining access, that it was inside a real company’s system rather than a simulated target, and it ended the intrusion there rather than continuing to explore or extract anything.

Google is treating that as evidence its safety training is working the way it’s meant to, even in a situation the model was never designed to handle. Critics of that framing point out that the model still needed to get inside a real system before it noticed anything was wrong, and that “it stopped once it realized” is a low bar for something with this much autonomy.

Not Just a Gemini Problem

Irregular has said the same testing flaw affected other major AI labs. OpenAI, Anthropic and Meta have each disclosed similar breakouts tied to the same underlying issue, all surfacing publicly within weeks of each other. Google’s disclosure, confirmed to the Wall Street Journal and other outlets on September 19, is simply the latest in that sequence, not an isolated failure unique to Gemini.

Why Researchers Are Watching This Closely

AI safety researchers have flagged a rise in what they call “loss of control” incidents — cases where an AI system does something its operators didn’t intend, even briefly. Most of these, including this one, have been low-stakes and short-lived. The worry isn’t this specific incident so much as the trend line: as AI agents get more autonomy and more access to tools like browsing, code execution and file systems, the space for something to go wrong quietly gets bigger.

The Bottom Line

This wasn’t Gemini choosing to attack anyone, and it wasn’t a security hole in Gemini itself. It was a test environment with a hole in it, and an AI model that did what it was told to do without knowing the walls around it had come down. Google says it has since fixed the testing process. Whether that closes the door on incidents like this, or just this specific version of it, is the question that’s left.

FAQs

Did Gemini get hacked?
No. The direction of events runs the other way — Gemini was the one carrying out the intrusion, not the one being broken into. A flaw in how a third-party security test was set up gave the model internet access it wasn’t supposed to have, and it used that access to get into three real companies’ systems. Nobody hacked Google or Gemini itself in this incident.

What went wrong with Gemini?
Technically, nothing was wrong with Gemini’s own code or training. What went wrong was the test environment built by Irregular, the outside firm hired to evaluate Gemini’s cybersecurity abilities. That environment was supposed to block internet access completely, and a bug let it through instead. Gemini then behaved exactly as it was designed to during the test — probing for weaknesses — except its targets turned out to be real companies rather than simulated ones.

Does Gemini AI spy on you?
Nothing in this incident suggests Gemini monitors or spies on regular users. This was a one-off failure inside a specialized security test, not a feature of how Gemini works for people using the app day to day. If anything, Google is pointing to the fact that the model stopped itself once it realized it had gone somewhere it shouldn’t have — as a sign its safety behavior held up, not as evidence of ongoing surveillance.