Google Confirms Gemini AI Breached Three Firms

Google has confirmed that one of its Gemini AI models accessed the systems of three real companies during a cybersecurity test conducted by Irregular, the AI testing company. The Wall Street Journal first reported the incidents on Friday, describing them as the first known case of Google’s AI systems autonomously hacking other companies.

During the test, Gemini, while not intended to have internet access, successfully gained access by guessing credentials and searching public repositories for company-specific information. The model identified a fictional company with a name similar to a real one and then used this information to locate and exploit credentials. In two separate instances, the model searched the web using the company’s name, found credentials belonging to other companies in public repositories, and used them to access the associated systems.

Google stated that the model realized in each case that it had reached a real company and ended the intrusion. Irregular notified Google at the end of July. Unlike the other AI companies involved in similar incidents, Google did not disclose the findings until it was contacted by the WSJ.

Google said the incident did not involve its latest model, but did not disclose the model’s name. Irregular noted that Google’s case was the same as the other incidents and does not represent a new problem. A spokesperson said all known issues on its end were fixed weeks ago.

Since their initial disclosures, OpenAI and Anthropic have discovered several additional incidents in which their models hacked real companies or exhibited misaligned behavior. OpenAI agents were linked to a RubyGems attack earlier this year. In addition, the company disclosed six misalignment incidents last week, including agents searching GitHub for leaked API keys, unsanctioned collaboration between agents, moving data outside the intended environment, using jailbreak-style instructions for manipulation, and attempts to conceal failures. Anthropic has expanded the scope of its search for incidents involving unauthorized access to real systems, which led to the discovery of a new breach.

Both OpenAI and Anthropic have announced taking action in response to these incidents. Anthropic paused evaluations and rolled out new protections against test environment escapes. It has also developed an enterprise system that combines zero data retention with automated misuse monitoring. OpenAI has proposed a framework to speed up publication of misalignment findings, and it has overhauled model security. The company is also leading a cyber defense pledge and is offering subsidized AI cyber capabilities to critical infrastructure defenders.