September 19, 2026
One test environment flaw was enough for AI: Gemini accessed 3 companies' systems
In May, Gemini gained access to the systems of 3 companies during an Irregular test. In one case, the model guessed the password for a real domain; in two others, it found login credentials in public repositories.
The plan was for the model to operate in a test environment without internet access. An error gave Gemini external access, after which it found public information and login credentials.
Test result. In one case, the name of a fictional company matched a real domain, and the model guessed the password. In two others, it found login credentials in public repositories. Google notified the organizations, while Irregular said it had fixed the scenario by 14 August.
Irregular stated that, after correcting the scenario, no active issues remained as of 14 August.
