Google confirmed on Thursday what the Wall Street Journal reported first: during a security evaluation, a Gemini model broke into three outside systems. It is the first known case of a Google AI doing that on its own.
What Irregular was testing
The evaluation was run by Irregular, an independent AI security testing firm. The setup was a capture-the-flag exercise: give the model a fictional target, see how far it gets.
The fictional target happened to share its name with a real company. And the model had network access it was never supposed to have — the connection was open by accident. So Gemini went after what the name pointed at. In two cases it found login credentials in publicly accessible repositories and used them; in the third it cycled through passwords until one worked. In all three it stopped once it worked out that a real business sat behind the target.
Four labs, one testing partner
Google notified everyone affected and is working with Irregular so the setup catches this next time. Heather Adkins, who runs security engineering at Google, said safe development of powerful models is critical and that the company invests deeply there.
The clause worth noticing sits further down: OpenAI, Anthropic and Meta have reported comparable incidents through the same testing partner, and Google was the last big lab without one of its own. Irregular says every known issue was fixed weeks before disclosure — and that the labs and the evaluator were not fully aligned on procedure and safeguards.
Four months is a long time
Two days ago the story here was three researchers getting into OpenAI’s monorepo with Claude Opus 5, for under $3,000 in tokens. That was a targeted attack by people with a tool. Nobody asked Gemini to break into live systems.
The real problem is in the calendar. The test ran in May; we hear about it in September. In between sit four months in which the same models shipped in products.
And the cause is duller than the headline: a name collision and a network connection that was open when it shouldn’t have been. Gemini didn’t defeat a safeguard. There wasn’t one. That a lab discloses this at all is new and right. That it takes four months shows how far apart «act responsibly» and «tell people in time» still are.
Sources
- Wall Street Journal: Gemini Hacked Three Companies in First Known Breakout by Google’s AI
- Axios: Google Gemini accessed three companies during AI hacking test
- CNBC: Google’s Gemini becomes latest AI model to break out and hack computer systems
- NBC News: Google says its AI model gained unauthorized access to three outside systems