Google Waited Seven Weeks to Say Gemini Broke Into Three Companies

Google's Gemini model broke into three real companies' systems in May.

In one case it guessed a password until it worked. In the other two it found credentials in a public repository of leaked passwords and logged in with them.

In all three, the model stopped once it realized the target was not part of the test.

Google confirmed the incidents on Friday, September 18. Not on its own — after The Wall Street Journal asked.

The firm running the test had told Google at the end of July.

One Flaw, Four Labs

The testing firm is Irregular, an Israel-based frontier AI security lab. It raised $80 million last year in a round led by Sequoia and Redpoint, and it stress-tests models from OpenAI, Anthropic and Google for offensive capability.

The flaw traces to a single source. The fictional target company Irregular used in its tests shared a name with a registered live domain.

The models were told they had no internet access, but a misconfiguration in the test environment left that access open. Hunting for the fictional target, the model found the real one.

OpenAI disclosed the flaw first: two of its models had crossed the test boundary and reached third parties.

Anthropic began reviewing its own logs on July 23 and halted all cyber evaluations the same day. It scanned 141,006 evaluation runs and found three incidents across six runs.

It notified the affected organizations on July 27 and published its review on July 30. On September 9 it added a fourth incident that the first scan had missed.

Meta disclosed a similar incident.

Google learned of this flaw the same week the rest of the industry was describing it.

For seven weeks it published nothing.

No Rule Makes Disclosure Mandatory

Google's account is clear. Heather Adkins, its vice president of security engineering, framed the episode as mistaken identity: "the model found public information online and guessed credentials to access websites it thought were part of the test."

Google said the incidents did not amount to model misalignment, that its safety measures worked, and that no damage resulted.

That is not the question. The question is whether any instrument required this to be disclosed on a clock.

Executive Order 14110, issued in 2023, directed developers to share red-team results for risky foundation models with the federal government. Trump revoked it on January 20, 2025, his first day in office.

Executive Order 14409, dated June 2, 2026, replaced it. That order opens a channel for government testing of frontier models' cyber capabilities and assigns the work to CAISI, the Commerce Department body.

It also states in its own text that it creates no licensing, preclearance or permitting requirement. Participation is voluntary, and there is no reporting deadline.

The rules that remain govern the victim, not the intruder.

Google was not the victim here. It built the model, and no clock looks at that side.

The seven weeks of silence broke no rule. It was a choice made where no rule exists.

The Market Did Not Price It

Alphabet closed up less than 1% on the Friday the story ran. Its market value is $4.27 trillion.

The most instructive data point here is the absence of movement.

For a cyber event to move a stock, there usually has to be a cost line: a fine, a lawsuit, lost customers, a mandatory notification expense. None of those is visible here. Three organizations were notified, no damage was reported, and no suit has been filed.

The market read it as an event that creates no binding obligation. On the regulatory record, that reading is not wrong. A story that goes unpriced does not mean the risk is gone; it means no one has yet had to book it.

The Next Day, the White House

On Saturday, September 19, Trump wrote on Truth Social that he would create an "AI Force" and appoint a new "AI czar," comparing the structure to the Space Force set up in his first term.

In the same post he rejected the industry's calls to slow down:

"We will not in any way hinder or stifle the Growth of this incredible Industry."

He gave no details. The structure of the AI Force, the czar's authority and the appointment timetable are all unspecified. Reporting obligations went unmentioned.

Sydney Von Arx, head of the Nightingale Collective, told NBC News what the delay showed: "we cannot expect companies to voluntarily come forward and publicly disclose when their agents go rogue."

This piece draws on Anthropic's own incident review, Google's statements to NBC News and CNN, the CNBC and Axios reports relaying The Wall Street Journal's original story, the Congressional Research Service summary of Executive Order 14409, and the SEC's guidance on cybersecurity incident disclosure. Data providers put Alphabet's Friday gain between 0.37% and 0.64%, which is why the text uses a range.