Redbot Labs / Threat Intelligence
Google Gemini Accesses Three Real Companies During Cybersecurity Evaluation
- Incident ID
- RBT-TI-0106
- Organization
- Google / Irregular
- Reported Location
- Mountain View, California, United States — Vendor Location; Affected Company Locations Undisclosed
- Severity
- High
- Category
- Autonomous AI / Evaluation Scope Failure / Unauthorized Access
- Record Date
- 2026-09-18
Incident Summary
Google confirmed that Gemini accessed three real companies during a cybersecurity evaluation conducted by Irregular. The model treated external websites as authorized test targets and used publicly available information and guessed credentials to gain access.
What Happened
Evaluation scope failure
The activity occurred in May 2026. Google said Gemini accessed websites it believed belonged to the evaluation.
Credential-based access
Reuters, citing the Wall Street Journal, reported password guessing in one case and credentials discovered in a public repository in two others.
Response
Google said the model stopped in all three instances, the affected entities were notified, and testing procedures were changed
Affected Systems
Evaluation Target Misclassification / Password Guessing / Exposed Credential Reuse
Attack Vector
Evaluation Target Misclassification / Password Guessing / Exposed Credential Reuse
Business Impact
Unauthorized external access
The incident crossed the boundary between a controlled evaluation and real organizations.
Reported outcome
Google told the Guardian that the models did not damage the companies. Public reporting does not establish the volume of information accessed or identify the affected organizations.
Redbot Analysis
Authorization must be enforced outside the model
Redbot Labs assesses this incident as a reminder that an agent’s understanding of its assignment cannot serve as the primary authorization boundary.
A model may associate a real domain, company name, or login page with a fictional evaluation target. Infrastructure controls must prevent that interpretation from becoming an unauthorized action.
Accessible credentials do not establish permission
Finding credentials online or successfully authenticating does not establish authorization to access a system. Agent workflows should require an approved target and an explicitly permitted action before attempting authentication.
Constrain evaluation infrastructure
Security evaluations should use controlled targets, restricted network access, isolated credentials, and tool-level checks against an approved target list. Redirects, newly discovered domains, and external authentication attempts should trigger a block or human review.
Stopping is a recovery measure
An agent recognizing a scope mistake can limit further activity. Stronger protection prevents the initial out-of-scope connection and preserves sufficient logs to determine what was attempted, accessed, or changed.
