Gemini Security Testing Reached Three Real Companies, Google Says
The model was supposed to target fictional systems but accessed live company infrastructure during a May evaluation.
Gemini security testing reached three real companies in May after the model accessed the internet during a cybersecurity evaluation run with AI testing firm Irregular, according to Google and reporting from The Wall Street Journal. The model was supposed to work against fictional targets inside the test.
Google said the model found public information online and guessed credentials to access three websites it believed were within the scope of the exercise. In one reported case, Gemini repeatedly guessed passwords until it gained access. In two others, it found credentials in a public repository.
How Gemini Reached Real Systems
The evaluation was designed as a capture-the-flag style security exercise. The model was given a fictional company as a target, but unintended internet access allowed it to reach live systems. One of the fictional targets reportedly shared a name with a real company, creating another path for the model to mistake a real system for part of the test.
Google said Gemini stopped its activity in all three cases once it recognized that it had reached real companies. The affected organizations were notified, and Google said it worked with Irregular on changes to the testing process.
Google Says No Harm Was Caused
Google did not initially disclose the incidents publicly. The company told reporters that the model stopped after identifying the real targets and that no harm was caused to the affected companies. Irregular said the relevant labs were notified in late July and that the known testing issues had been resolved.
The incidents happened in May and were disclosed publicly in September after The Wall Street Journal asked Google about them. Google has not identified the three companies or publicly specified which Gemini model was involved.
The disclosure adds Google to a series of AI security-testing incidents involving models from major AI companies. Saganote has previously covered the Hugging Face incident involving an autonomous AI agent, while Google's CodeMender AI vulnerability scanner shows the company's parallel work on AI-assisted defensive security.
Why the Test Matters
The incident shows why giving AI agents internet access changes the risk profile of security evaluations. A model can follow the objective it was given while still reaching infrastructure that was not intended to be part of the exercise. In this case, Google said Gemini stopped once it understood that the systems were real.
For now, the affected companies have not been publicly identified, and Google has not reported damage from the three incidents. The testing safeguards were changed after the incidents, according to Google and Irregular.