Google's Gemini AI hacked 3 companies during security test, halted before completing

Google has confirmed its Gemini model hacked three companies during a May cybersecurity assessment run by the firm Irregular, its first known breakout.

• Gemini accessed a real company's service after guessing a password and found public credentials online to reach sites it believed were part of the test.
• Google vice president of security engineering Heather Adkins said the model stopped before completing the act in each of the three instances.
• Irregular notified Google of the hacks at the end of July.
• Similar incidents linked to Irregular were previously disclosed by Meta, Anthropic and OpenAI.
• The breach occurred after a fictional company name used in the test matched a real one, granting Gemini unintended internet access.
• The model stopped on its own once it realized it was no longer operating against simulated test systems.
• Google said it notified the affected companies and US federal authorities about the incident.