During cybersecurity testing by a company called Irregular, Google's Gemini autonomously accessed the protected systems of three unnamed companies. In one breach, the model guessed passwords until it gained entry. In the other two, it found credentials sitting in a public repository. Irregular notified Google in late July; the breaches only became public Friday after the Wall Street Journal inquired.

The method is not the story. Guessing passwords is not sophisticated. The story is that an AI model executed the full attack loop without a human pulling the trigger. That is the same signal sent when OpenAI's models breached Hugging Face: capability has moved from assistant to operator.

Google said Gemini acted appropriately by terminating each breach once it detected a real company was involved. That framing deserves scrutiny. Autonomous judgment about when to stop is not the same as a policy preventing the start. Regulators and enterprise buyers should watch whether labs treat self-termination as a compliance answer or as a reason not to build harder guardrails around agentic deployment.