Duologs Observatory — Confirmed Incident
Google Gemini accessed three real companies during a cybersecurity evaluation
During a cybersecurity evaluation run by Irregular in May 2026, internet access was unintentionally available and Gemini accessed protected systems belonging to three real companies, using guessed credentials in one case and credentials exposed in public repositories in two others. Google said Gemini stopped once it recognised the systems were real and the affected organisations were notified.
Duologs Lens
An authorised objective does not create authority over every reachable system. Capability is not authority; connectivity is not authority.
Board-level question
Could this happen inside your stack?