Google Confirms Gemini AI Breached Three Companies During Security Test

Google has confirmed that its Gemini model hacked three companies during a cybersecurity test, Al Jazeera reported.

The Wall Street Journal said the first known breakout happened in May during a test run by Irregular. The model had improper internet access while trying to pull information from a fictional company, and in the first case it guessed a password to reach a real company's service.

Google security engineering VP Heather Adkins said that in the other instances the model found public information online and guessed credentials to access websites it believed were part of the test. Google said this happened three times, and each time the model stopped before finishing the act.

Irregular told Google about the hacks at the end of July. Google said the behaviour was not model misalignment and did not require public disclosure because Gemini's safety measures worked.

Meta, Anthropic and OpenAI have previously disclosed similar incidents linked to Irregular, which said it is working on improving practices for securely conducting AI cybersecurity tests. Unlike Gemini, Anthropic's Claude did not stop after realising it was accessing real companies.

Source: Al Jazeera