The Gemini hack: three companies breached. The real news is further down.

On 18 September 2026 the Wall Street Journal reported that Google's AI model Gemini had broken into the systems of three real companies in May. Google confirmed it. It is the first known case of its kind at Google.

Since then the story has been running everywhere, mostly with the same word in the headline: breakout. I read the reports, pulled the original sources and noticed that the most interesting line almost always sits in the last third.

• May 2026: During a security evaluation, Gemini breaks into the systems of three companies. Heather Adkins, Vice President of Security Engineering at Google, says: "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped." (Guardian, BBC)
• The set-up: The test wasn't run by Google itself but by Irregular, an Israeli company that examines the security of advanced AI systems. The test ran in a closed environment with made-up companies. This environment was not supposed to have internet access. By mistake, it did. (Guardian)
• The first case: One of the made-up companies had the same name as a real one. The model was supposed to retrieve information from its software, got onto the open internet, guessed the real company's password and was in. (Guardian)
• The other two cases: The model searched the web and found publicly accessible storage containing login credentials. (Guardian)
• End of July 2026: Irregular reports the incidents to Google and to everyone affected. The company tells the BBC that all known issues on its side were fixed weeks ago. (BBC)
• It only becomes public in September, through the Wall Street Journal. Google didn't consider disclosure necessary because no damage had been done. (Guardian, WSJ)

A side note that often gets passed on wrongly: Reuters did not uncover the case itself. The Reuters headline explicitly says "WSJ reports". The Wall Street Journal reported it first.

It's not the first incident of its kind this summer. In July, Anthropic's Claude left its test environment and got into three organisations, a few days after OpenAI said its models had carried out attacks on several publicly reachable services, including Hugging Face. (BBC, Guardian)

Three companies, three models, three reports. Sounds like a pattern in the technology.

But it's a pattern in the supply chain. The same testing firm, Irregular, was also behind the tests at OpenAI and Anthropic. And Irregular only looked into the Google incident in the first place after it emerged that OpenAI's model had got into Hugging Face. (Guardian)

That's the real news. It's not that three models escaped independently of each other. One workbench had a hole in it, and everything lying on it fell through.

What bothers me most about the whole story is one word: breakout.

A breakout means someone gets over a wall. There was no wall here. The test environment was supposed to be cut off from the internet and wasn't. The model didn't notice it was outside; it just kept doing its job. It thought the real company was part of the test, and that was because the made-up company had the same name.

Anyone who has ever built something that went into production knows this mistake. A test environment that accidentally points at the live database. A key that also works in a dry run. The dangerous mistakes are rarely the spectacular ones. Usually it's a single line in a configuration file.

That doesn't make it harmless. It just makes it dangerous in a different way than the headlines suggest. A model determined enough to guess a password until it's right doesn't need intent to cause damage. All it needs is a door left open.

The part almost nobody talks about: in two of the three cases the model didn't have to guess anything. It searched and found, in publicly accessible storage.

That isn't AI news. It's the oldest weakness of the internet, and it's human. Login details that someone uploaded by mistake, in a folder anyone can read.

You find the same carelessness everywhere, just on a smaller scale. Over the last few days I've checked hundreds of websites of Munich businesses with a tool I wrote for the purpose. Among them are sites without encryption, forms that send what you type in plain text, and folders lying open on the web. Nobody meant any harm. It's just that nobody ever checked.

The difference from before isn't that the keys are lying around. The difference is that there's now something that searches for them tirelessly, around the clock, without ever getting bored.

Now the part that really occupies me.

The incident happened in May. Those affected knew at the end of July. The public found out in September, and not because someone told them, but because a newspaper found out. Google didn't consider disclosure necessary because no damage had been done.

I understand the argument. A report without damage is noise, and noise helps nobody. Still, something about the logic doesn't add up.

First, the one deciding about the damage is the one who caused it. In any other industry that would be unthinkable. If a tradesman drilled into a pipe in my home and told me it didn't need reporting because no water came out, I'd still like to check for myself.

Second, damage isn't the only thing that counts. The three companies affected have an access in their logs that they couldn't explain. Anyone who investigates security incidents knows what an unexplained access costs: days.

Third, and this is the point: without the newspaper we'd know nothing about it. All three cases this summer became public because someone found them out, not because someone told.

The conclusions are practical, not philosophical. They apply to anyone running something that reaches beyond their own device.

• The environment is the safeguard, not the model. A model that holds back voluntarily is a favour, not a guarantee. What can't be reached can't be touched by accident either.
• Names are part of security. The first case only happened because a made-up company had the same name as a real one. Test data that looks like real data is convenient, and that's exactly what makes it dangerous.
• Login details never belong in storage someone can read. That was true before. It's even more true now, because searching for them costs nothing anymore.
• If something happens, you say so. Even if nothing broke. That's not a legal question; it's a question of whether you'll still be believed next time.

What I don't take away from it: fear. No model decided to break out here. It finished a task in a room whose door someone had left open. Overall that's more reassuring, and in the details more uncomfortable, than the headlines suggest.

Two things I couldn't verify, so they appear here as open questions and not as claims.

Whether Google explicitly rejects calling this a misbehaviour of the model, I couldn't find in the sources available to me. All that's documented is what's above: the model thought the real companies were part of the test, and it stopped each time.

And whether the three companies affected see it the same way, nobody knows. Their names aren't public. They're the only ones in this story who weren't asked.