Gemini Broke Into Three Real Companies, and Google Stayed Quiet | 2 Minute Drill with Drex DeFord

UnHack with Drex DeFord · Sep 27, 2026 · 4m

In May, a Tel Aviv company called Irregular was testing Google's Gemini inside a sandbox. A bug left a live internet connection open. The test target shared a name with a real company, and Gemini found it. It guessed passwords until one worked, then used logins sitting in a public repository to get into two more. Three real organizations. The model stopped and backed out. Irregular flagged it to Google in late July. Google notified the three companies and federal authorities, then sat on it for almost seven weeks. The rest of the industry did not hear until the Wall Street Journal asked, and…