COMMENTARY: In May 2026, an independent testing firm called Irregular ran a security test on Google's Gemini.
During that test, Gemini broke into three companies on its own. Google confirmed this happened. The testing happened in May, but Google’s confirmation became public in September, putting the incident back at the center of the AI security conversation. Their VP of Security Engineering, Heather Adkins, said all three companies were told about it, and that Gemini stopped hacking once it got in.
Here's the part that matters: in two of the three cases, Gemini didn't need to break anything. It found a real, working credential just sitting in a public code repository and used it, the same way anyone with that credential could have. In the third case, it guessed a password until one worked. Two different problems, but they both got lumped into one "AI hacked us" headline, because "AI went rogue" sells better than "someone left a working credential in a public repo and never revoked it."
[
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
And this wasn't just a Gemini thing. When Irregular ran the same test on models from Meta, Anthropic, and OpenAI, they got similar results. So this isn't a Google problem, or even a "powerful AI model" problem. It's a mirror. Any model that doesn't get tired, doesn't need to look things up, and can work at machine speed will find the same weak spots already sitting inside your environment … just faster than your team would.
This was never really an AI story
The password-guessing case is an authentication problem. Rate limiting, lockouts, credential complexity. Real, boring, not what this piece is about. The credential-discovery cases are the ones that should bother you, because they're not the exotic case, they're the default case.
GitGuardian's 2026 State of Secrets Sprawl report found 28.65 million new hardcoded secrets committed to public GitHub in 2025 alone, a 34% jump year over year, the largest single-year increase they've ever recorded. That is the number that should worry an entire industry. When you dive deeper, you find that AI-service credentials specifically were up 81%. And the part that actually matters: of the secrets confirmed valid in 2022, 64% were still live and exploitable in January 2026. Four years later. Nobody rotated them or even noticed. GitGuardian also found that 60% of secrets-policy violations involve long-lived credentials. The part that AI changes most dramatically is not the existence of the weakness, but the speed at which it can be discovered and used.
A public repo is not a secrets vault, and every team that treats it like a locked drawer should assume those credentials have been discoverable for as long as they've been sitting there … they just haven't gotten the incident report yet. Gemini didn't invent this exposure. It just showed up to a problem that's been sitting there, fully valid, since before most current employees joined the company. The models just got to the problem much faster. And that speed is becoming operational, not theoretical. The failure is the same one it's always been: a long-lived, fully scoped credential sitting somewhere it shouldn't, waiting for literally anything, human, script, or model, to trip over it.
Google Threat Intelligence
reported this month that attackers are already moving from simple AI prompting to agentic workflows. In one case, attackers compromised a cloud resource and built and executed an agent-assisted credential-harvesting campaign in under six hours. Secrets that once sat exposed for months or years can now be discovered, tested and operationalized in hours.
Where this goes next: agentic browsers
If the Gemini eval is the credential-hygiene version of this story, a newer disclosure shows the same failure with a much bigger blast radius: the browser.
This month, researcher Gal Weizman
found a way to hijack the AI assistants built into browsers. He calls it BragJack. It's not a real attack happening in the wild, it's a proof of concept, and Google and Microsoft have already fixed it.
Here's how it worked. Weizman splits these AI browser agents into two parts: a "brain" (the AI model) and a "body" (the browser tool that actually clicks, types, and reads pages for you). BragJack goes after the body. A malicious browser extension rewrites the traffic the AI trusts, so it starts following the attacker's instructions instead of yours. In Edge, there was also a short window, a race condition, where a command could sneak through before the safety checks kicked back in.
The proof of concept worked across AI capabilities in Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome. Depending on the browser, an attacker could potentially access files or browser data, take screenshots or abuse camera and microphone permissions
Different mechanism than the Gemini eval, extension trust abuse instead of a leaked key, identical root failure. Something got handed broad, standing, implicit trust, a static secret in a repo, an extension sitting inside the same privilege boundary as the AI agent, and nothing checked, at the moment of action, whether that trust should still apply. Agentic browsers make the problem harder because the agent can inherit the user’s already-authenticated world. The browser may already be logged into email, SaaS applications, internal tools and cloud consoles. At that point, the question is no longer simply whether the agent authenticated. It is whether this agent, acting for this user, should be allowed to take this action right now
What security teams should take from this
Stop asking "could an AI model hack us." Assume yes, and assume it gets better at this every quarter. Ask instead: “of the credentials sitting in our repos right now, how many are still valid, and how long have they been that way?” Then ask a harder question: “how much standing access are we giving it to find?” If your honest answer is "we don't actually know," you already have your answer to the first question too.
In a nutshell
Google confirmed that Gemini accessed three companies during its security testing, which makes this more than a hypothetical about what capable models may eventually do. But Gemini still didn't need a fundamentally new way to get in. In two cases, it found valid credentials that were already exposed. In the third, it guessed a password. And BragJack didn't out-hack five browser vendors either. Something was handed standing trust and nobody came back to ask whether it still deserved it.
AI is making standing access less forgiving. The leaked credential that used to sit unnoticed for four years now has machines actively looking for it. The browser session that once depended on a human clicking the wrong thing now has an agent capable of acting through it. We don't need to invent a mysterious new identity problem for AI. We need to stop handing identities broad, persistent access and assuming we'll notice before somebody, or something, uses it.
