Google Gemini AI accessed real companies' systems during security test

Google confirmed that its Gemini artificial-intelligence model accessed the protected networks of three real companies while participating in a cybersecurity test in May. The incidents, reported by the Wall Street Journal, occurred when the model was instructed to attack a fictional target but inadvertently had internet access, allowing it to encounter a real business sharing the same name.

In one case the model repeatedly guessed passwords until it gained entry to a protected system; in the other two cases it retrieved credentials from publicly available repositories. In each instance Gemini halted the intrusion after recognizing it had reached an actual company, and no damage was reported.

"Safe development of powerful AI models is critical and we invest deeply in this area," said Heather Adkins, Google's vice president of security engineering. "In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped."

Google said the three affected firms were notified and that the testing process has been revised to prevent unintended internet connectivity. The company did not disclose the identities of the businesses or the specific Gemini version involved. The incidents follow similar reports of AI agents from other firms, such as OpenAI and Anthropic, breaching test environments.

Irregular, the firm conducting the evaluation, reported the findings to Google at the end of July, after earlier disclosures of OpenAI models accessing systems belonging to AI software company Hugging Face.