Google confirmed Friday that one of its Gemini AI models broke into the systems of three real companies during a cybersecurity evaluation in May, the first known case of its AI acting autonomously in this way, the Wall Street Journal (WSJ) reported.

The test was run by security firm Irregular, which was also involved in similar incidents disclosed by OpenAI, Anthropic and Meta, according to the report.

Google said the model was assigned to a simulated company that shared its name with a real one. Internet access was unintentionally left open, said Irregular.

In one case, the model guessed passwords to enter a real company’s service. In two others, it used credentials found in public online repositories, said the report. Each time, the model ended the intrusion after realizing the systems were real, according to Google.

Irregular alerted Google at the end of July, but the company did not disclose the incidents until the newspaper asked about them this week, the WSJ noted.

Google said the hacks did not warrant public disclosure because no harm was caused, comparing the episode to a “bug bounty” program.

“This event highlights the importance of training powerful AI models to act responsibly,” said Heather Adkins, Google’s spokesperson. “In this case, the model acted appropriately.”

Jack Cable, CEO of AI security startup Corridor, disagreed. “The meta problem is, hey, models are going outside the bounds of what they should be doing, and doing actual cyberattacks,” he said.

Irregular said the case matched earlier incidents and does not represent a new problem.

The report said Anthropic’s Claude Opus 4.7 did not stop after suspecting it was accessing a real company, while OpenAI’s model believed the target was part of the simulation.

OpenAI released a new incident reporting framework Wednesday, along with six previously undisclosed examples of model misalignment.