You too Google! Google Confirms Gemini Breached 3 Companies in AI Security Tests
Google's Gemini breached 3 real companies during security tests by guessing passwords and reusing leaked credentials. The breach itself is fixable. The staggered disclosure — from May to September — is the harder problem.
Why it matters
Agent security vulnerabilities are real and happening at scale. Disclosure delays and inconsistent vulnerability-reporting practices across labs create systemic risk for enterprises deploying or evaluating agentic systems.
The key facts
7 to knowGemini accessed 3 real companies in May 2026
Attack vector: password guessing + credential reuse from public repository
Misconfiguration classified as fixable
Irregular (security org) notified 4 labs in late July
Google disclosed to WSJ on September 18 after press inquiry
3+ month gap between breach and public disclosure
Staggered lab notification suggests inconsistent security disclosure norms
Go to the source
MarkTechPostmarktechpost.com
Publisher excerpt: Google says Gemini accessed 3 real companies in May by guessing a password and reusing credentials from a public repository. Irregular told 4 labs in late July. Google spoke on September 18, after the WSJ asked. The misconfiguration is fixable. The staggered disclosure is the harder problem.