Google confirmed that Gemini models hacked three companies in May 2026 during a cybersecurity test by Irregular. A misconfiguration gave the models Internet access during a closed capture-the-flag exercise; they hit real infrastructure instead of fake targets. One breach used password guessing; two