Leaked Credentials Let Four AI Models In. Check Yours.

The short version: Google disclosed on September 18 that its Gemini model reached the systems of three real companies during a security evaluation. In two of the three, it did not exploit anything. It searched the company’s name, found working credentials sitting in a public repository, and logged in. Google is the fourth major lab in two months to disclose something like this. The useful part is that the search the model ran is one you can run against your own business, and at the size most shops operate at, it is free.

That is the whole mechanism, and it is not the one most people picture. Nobody wrote an exploit. A model was given a task, given a browser, and went looking. What let it in was a password left somewhere public and never turned off.

What Google actually disclosed

The evaluation was run in May 2026 by Irregular, a frontier security lab that tests advanced models for cyber capability. Irregular notified Google at the end of July. Google confirmed nothing publicly until the Wall Street Journal asked in September, roughly seven weeks later, and that silence drew the sharpest criticism. Jack Cable of Corridor argued Google was leaning on vulnerability disclosure norms to avoid saying plainly that its model had carried out real intrusions.

Heather Adkins, Google’s vice president of security engineering, put it this way to SecurityWeek: “In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped.”

Google calls this mistaken identity rather than misalignment: the model believed it was still inside the test range, realized the systems were real, and halted. Reasonable people are arguing about whether that justified the delay. The mechanism itself is not in dispute, and it is the part that matters here.

In one case the model reached a protected system by guessing credentials repeatedly. In the other two it searched the web using the target company names, found credentials in public repositories, and used them. Meta, OpenAI and Anthropic have all disclosed comparable results through Irregular’s testing. We covered the Anthropic sandbox escapes and the OpenAI models that reached Hugging Face’s servers when each was disclosed.

Why “it logged in” matters more than “it hacked in”

Four instances stop being an incident and start being a property of the category. Across all four labs the pattern is the same, and it is unglamorous: weak passwords, exposed credentials, things left switched on. Not novel exploits.

What changed is the economics. A human attacker has to decide your business is worth an hour. A model running a task decides nothing of the sort. It searches, it finds, it tries, and the cost of doing that to one more company rounds to nothing. Obscurity was never protection. The price of a person’s attention was, and that price is falling.

The encouraging half is the shape of the fix. If the way in is a credential that leaked and stayed valid, the defense is not a security product. It is an afternoon of cleanup, and the finding half is free.

How do I check if my business credentials leaked?

Two checks cover most of what the model found. Both terms below were read off each vendor’s own page on September 21, 2026.

Check one: your email domain. Have I Been Pwned runs a domain search that lists which addresses at your domain appear in known breaches. You verify you control the domain, then it shows them. The free tier covers domains with up to 10 breached addresses, which is most small businesses. Above that it becomes a subscription, starting at Core 1, $4.39 a month or $52.68 a year, for one domain and up to 25 breached addresses. Note how the meter works: domain size is counted in breached addresses, not in how many mailboxes you have. A ten-person shop sits comfortably in the free tier.

Check two: your code and config. This is the one that matches what Gemini did. If your business has ever had a website built, an app made, or an integration wired up by a contractor, there may be a public repository with your name on it. GitHub runs secret scanning on every public repository automatically and at no cost, looking for generic patterns such as private keys and database connection strings, partner patterns from providers like AWS, Azure and Stripe, and passwords identified by a machine learning model. If you have a repository, those alerts are already sitting in its Security tab. Nobody has to buy anything to go and read them.

The gap the free tools leave

Here is the part the coverage did not reach, and it explains why those credentials still worked months after they were committed.

Detection is not revocation. GitHub tells you a secret leaked. It does not turn that secret off. The credential stays live until a person rotates it, rotating is manual, and it is the step that gets skipped because nothing breaks when you skip it. That is precisely the state Gemini found those three companies in.

A second gap is unusually relevant here. On a free public repository, push protection, which blocks a secret before it ever lands, covers generic patterns and most provider patterns. It does not cover the machine-learning password detection. Plain passwords get an alert after the fact, not a block before it, and a plain password is exactly what the model used. Validity checking, the feature that tells you whether a leaked credential still works rather than merely that it leaked, requires GitHub Team or Enterprise with Secret Protection enabled. The free tier hands you the list. Working out which entries are still live is on you.

What this changes if you are connecting AI tools to your business

Most small businesses are being asked this quarter to plug an AI tool into something that matters: the inbox, the booking calendar, the CRM, the payment processor. This disclosure is not an argument against doing that. It is an argument for being deliberate about what you hand over, because an agent with a credential will use that credential.

Three things worth doing before the next integration. Give each tool its own credential rather than a shared one, so you can switch off exactly one thing without breaking everything else. Scope it to what the tool actually needs, not to everything your account can reach. And write down what you granted, because the access you cannot remember granting is the access nobody ever revokes. The same logic covers what an agent can see in a browser session, which we went through when a single planted comment was enough to hijack a browser agent.

The honest read is not that AI has become a threat your business cannot answer. It is that a capability which used to need a specialist is now cheap and fast in every direction, including yours. The model found those credentials with a search. You can run the same search on yourself first.

Frequently Asked Questions

Did Gemini actually break into real companies?

Yes. Google confirmed that during a May 2026 evaluation run by the security lab Irregular, its model gained access to systems at three real companies, one by repeatedly guessing credentials and two by finding credentials in public repositories. Google says the model stopped in all three cases once it recognized the systems were real, that no damage was done, and that it considers the episode mistaken identity rather than the model going off-instruction.

How do I check if my business credentials leaked?

Start with two free checks. Have I Been Pwned’s domain search lists which addresses at your domain appear in known breaches, and it is free for domains with up to 10 breached addresses. Then, if your business has any public code repository, GitHub’s secret scanning already runs on it automatically at no cost and puts any findings in the Security tab. Both terms were verified on September 21, 2026.

Does GitHub turn off a password once it finds one?

No, and this is the step people miss. GitHub’s secret scanning raises an alert telling you a credential was exposed, but the credential keeps working until somebody rotates it manually. On a free public repository you also do not get validity checking, the feature that tells you whether a leaked credential is still live. That requires GitHub Team or Enterprise with Secret Protection enabled.

Should this stop me connecting AI tools to my business systems?

No, but it should change how you grant access. Give each tool its own credential instead of a shared one, limit it to the systems that tool genuinely needs rather than everything your account can reach, and keep a written record of what you granted to whom. An agent will use whatever access it has, so the practical control is deciding what it can see in the first place.

If you went and looked right now, would you even know which old logins are still switched on for your business? We would genuinely like to hear what people find.