Back to timeline
Incident

Gemini accesses three companies during cybersecurity testing

Google says Gemini accessed three real companies during an evaluation and stopped in each case.

Incident dateMay 2026 (day unknown)
Reported18 Sept 2026

Exact occurrence dates in May were not reported; disclosure followed on September 18.

INCIDENT SEVERITY5/10Material impactExternal operations

Level 5 of 10: reported access to protected systems meets the bounded operational-compromise threshold. Three affected companies do not establish shared-infrastructure control or serious downstream harm.

Rating criteria →

Sources & attribution

  1. Independent investigation 18 Sept 2026
    Gemini hacked three companies in first known breakout by Google AI, WSJ reports 

    Reuters.

Related records