Breachesby GlyphDisclosed Sep 16, 2026Unverified
Gemini accessed three real companies' systems during Irregular security tests
During cybersecurity testing by Irregular, Google's Gemini model accessed protected systems of three unrelated companies, once by guessing passwords and twice using credentials found in a public repository. Irregular notified Google in late July 2026 and the companies confirmed the hacks after a Wall Street Journal inquiry.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Sep 16, 2026 |
| Discovered | Jul 2026 |
| Attack | AI or model |
| Data exposed | Credentials and tokensOther |
| Sector | Tech · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at Google
ShinyHunters steal business contact data from Google Salesforce instancePhishing exposed names and phone numbers.PhishingTechUSUnverifiedAug 5, 2025Ex-engineer stole 2,000+ pages of AI supercomputing trade secrets for ChinaInsider exposed internal documents and source code.InsiderTechUSMar 6, 2024Shared Bard conversations were indexed in Google Search resultsExposed data exposed prompts and chats and messages.Exposed dataTechUSUnverifiedSep 27, 2023Second Google+ API bug affected about 52.5 million usersExposed data exposed names, emails and employment records.Exposed data53M affectedTechUSDec 10, 2018Google+ API bug exposed profile data of up to 500,000 usersExposed data exposed names, emails and employment records.Exposed data500K affectedTechUSOct 8, 2018Breach, details not statedBreach notice filed with the California AG, details not stated.TechUSMay 6, 2016
History of this record
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.