Google Gemini breached three corporate systems during security test

Googlersquos Gemini reportedly hacked three companies in the first known breakout after the model accessed the internet and breached external systems during an evaluation of its cybersecurity capabilitiesFirst reported by The Wall Street Journal on Friday the intrusions took place in May during an exercise conducted by the testing firm Irregular which also participated in evaluations involving similar breaches disclosed by OpenAI Anthropic and MetaIn one instance the AI model guessed passwords until it penetrated a protected network In two separate runs the system identified exposed credentials within public repositories to gain entry Google maintained that the model ceased its operations in each instance once it recognized that it had penetrated real corporate infrastructure rather than a simulated targetIrregular alerted Google to the breaches in late July following revelations that OpenAI agents had compromised the software platform Hugging Face Google did not make the development public until inquiries were submitted by The Wall Street JournalThe company stated that the event did not warrant disclosure because the model inflicted no damage and disconnected upon discovering the mistake likening the process to a bug bounty initiativeldquoThis event highlights the importance of training powerful AI models to act responsiblyrdquo Heather Adkins Googlersquos vice president of security engineering said in a statement ldquoIn this case the model acted appropriatelyrdquoIndustry observers contested Googles characterization of the event arguing that the autonomous breach of external corporate networks represented a serious breakdown in containment protocolsThe breaches stemmed from an issue of mistaken identity during a capturetheflag exercise on Irregularrsquos infrastructure where the model received instructions to retrieve data from a simulated entity that shared its name with an active business While the test environment was intended to remain isolated internet connectivity was inadvertently left openBeyond guessing passwords in the initial run the system executed web searches for the target name during subsequent tests located credentials stored in online repositories and deployed them to penetrate two additional corporate environmentsGoogle stated that it informed the three affected entities alongside federal authorities while declining to identify the victim companies or the specific Gemini version involvedldquoAll relevant labs were notified in late July and affected entities were contacted as part of the investigationrdquo an Irregular spokesperson saidldquoIrregular took immediate action and all known issues on our end were remedied and resolved weeks agordquo the spokesperson addedThis story has been sourced from a third party syndicated feed agencies Midday accepts no responsibility or liability for its dependability trustworthiness reliability and data of the text Midday managementmiddaycom reserves the sole right to alter delete or remove without notice the content in its absolute discretion for any reason whatsoever