Google’s Gemini reportedly hacked three companies during a security test

The Wall Street Journal reports that Gemini hacked three companies in its first known “breakout.” A user claims the incident occurred during an Irregular security test in May 2026, with Gemini guessing a password once and using leaked credentials from a public repository twice. The same user says Gemini stopped on its own when it realized the targets were real organizations. The Journal reports that Google did not consider the incident an instance of model misalignment.