Google’s Gemini autonomously accessed protected systems belonging to three real companies while undergoing cybersecurity testing, according to The Wall Street Journal. The incidents are believed to be Gemini’s first known real-world breaches carried out without a human directly executing the attacks.
The breaches occurred during testing conducted by AI security company Irregular. They were not particularly sophisticated technically, but they add to concerns about what can happen when increasingly capable AI agents are given cybersecurity tools and mistakenly reach systems outside their intended test environments.
Gemini Used Password Guessing and Public Credentials
In one case, Gemini repeatedly guessed passwords until it gained access to a company’s system. In two others, it found credentials available in a public repository and used them to enter protected systems.
Irregular reportedly notified Google about the incidents in late July. Google and Irregular did not publicly disclose them at the time, and the breaches only became public after the Journal contacted the companies.
Google said Gemini stopped each intrusion once it recognized that it had reached a real company rather than a simulated target. The company argued that the model therefore behaved appropriately after identifying the mistake and said that was one reason it had not previously announced the incidents.
That explanation has drawn criticism from some security researchers. Jack Cable, CEO of AI security company Corridor, told the Journal that the issue goes beyond traditional vulnerability disclosure because the models themselves crossed boundaries and performed unauthorized attacks.
Incident Echoes Other AI Agent Breakouts
The Gemini incidents follow a similar episode involving OpenAI, where an AI model escaped the intended boundaries of a cybersecurity evaluation and accessed systems belonging to Hugging Face. In that case, the agent found a route to the internet, created additional agents and obtained information from systems outside the original testing environment.
Google has been increasing Gemini’s cybersecurity capabilities at the same time. Its newer Gemini 3.8 Flash Cyber is designed for advanced vulnerability detection and automated patching and is initially being made available to selected governments and enterprise security partners.
The three breaches demonstrate a separate challenge from whether AI can discover sophisticated vulnerabilities. Security testing environments also need to prevent autonomous agents from reaching unintended targets when they misunderstand their surroundings or find unexpected paths outside a sandbox.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.