Google confirmed that in May this year Gemini he succeeded access the systems of three real companies during a test on cybersecurity capabilities. The episode, which emerged through an investigation by the Wall Street Journal, was made public only after the newspaper contacted the company directly and follows attacks on real entities by OpenAI and Anthropic models.
The test was conducted through Irregulara company specialized in the security of artificial intelligence systems already involved in previous evaluation activities which had also involved OpenAI, Meta and Anthropic models. The goal was verify Gemini’s capabilities in identifying and exploiting cyber vulnerabilities in a controlled environment.
The problem is that, on at least three occasions, the model went beyond the expected perimeter. According to information reported by the Wall Street Journal, in one case Gemini would have tried until you guessed a passwordthus managing to access the system of a real company. In the other two episodes he would instead have used credentials identified within public repositories.
The central element of the story is precisely the overcoming of the test environment. Gemini would have to operate without Internet accessbut Irregular explained to the Wall Street Journal that this access had been unintentionally left available. Once systems belonging to real organizations have been reached, the model would have stopped anyway.
Google does not consider the episode a case of “misalignment”that is, behavior not aligned with the objectives and established constraints. The fact that Gemini acknowledged that it had broken into real systems and disrupted the activity represents, according to Google, a behavior consistent with the safety measures adopted.
Heather Adkins, vice president of Security Engineering at Google, said: “In this case, the model acted correctly.” When asked by The Verge, Adkins explained further: “The model found public information online and guessed credentials to access websites that it thought were part of the test. In all three of these cases, the model stopped.”
Google did not disclose the names of the three companies involved, but confirmed that it had informed them of the incident. The episode was also communicated by Google to the US federal authorities. However, it was not specified which Gemini model was used during the test. However, the date of the accident allows us to exclude the most recent Gemini versions.
