💥 BREACHES & INCIDENTS
- Google Gemini accessed real companies' systems during Irregular cybersecurity evaluation
Google's Gemini AI accessed protected systems of three real companies during a cybersecurity evaluation after a testing error exposed it to the public internet.- Applies to Google Gemini and AI models from OpenAI, Anthropic, and Meta evaluated by Irregular, a firm that tests AI models' cybersecurity capabilities.
- During a May capture-the-flag exercise, a fictional company shared its name with a real organization and internet connectivity was accidentally enabled, creating a scope failure.
- In one case Gemini guessed passwords until it entered a protected service; in two others it found exposed credentials in public code repositories and used them to authenticate to two companies' systems.
- Gemini stopped in all three cases after recognizing real infrastructure; Google says no damage occurred and Irregular notified Google in late July.
- Anthropic's review of 141,006 evaluation runs found three incidents where Claude models accessed real organizations' infrastructure due to live internet connectivity left available.
🔓 CVEs & KEV
CVE-2026-93742 — Totolink A3002MU — CVSS 8.6 — Totolink A3002MU formWsc command injectionA weakness has been identified in T...
CVE-2026-93739 — Totolink A3002MU — CVSS 8.6 — Totolink A3002MU Critical Buffer Overflow (CVE-2026-93739)