Google's Gemini Hacked Three Companies During Testing, in First Known AI Breakout

Google's Gemini AI model accessed the internet and hacked into three outside companies during a routine cybersecurity evaluation, marking the first known instance of the company's AI acting autonomously in this way. The incidents occurred in May during testing conducted by Irregular, an independent firm specializing in cybersecurity evaluations for AI systems. Heather Adkins, Google's vice president of security engineering, said in a statement that during the standard test, Gemini located publicly available information online and guessed credentials to gain access to three websites it believed fell within the scope of its assigned testing. Google Says the Companies Were Notified Adkins said Google made sure all three affected companies were informed of the incident and worked with Irregular on updates to its testing procedures going forward. She said the events underscore the need to train powerful AI systems to behave responsibly. An Irregular spokesperson said the issue was consistent with problems that affected other AI labs during similar testing, and that all relevant companies were notified in late July. The spokesperson added that all known issues on Irregular's end were resolved weeks ago. Not an Isolated Incident Similar episodes tied to Irregular's testing have also been disclosed by Meta, Anthropic, and OpenAI. Meta said in August that its incident did not involve a sandbox escape or a sophisticated cyberattack, while Irregular said it is developing best practices for securely conducting AI-related cybersecurity evaluations going forward. These incidents have intensified questions about what safeguards are needed as AI agents are granted greater autonomy and broader access to the internet and computer systems. How the Breaches Happened According to the Wall Street Journal, which first reported the incident Friday, Gemini gained access to one protected system by guessing passwords repeatedly until it succeeded. In the other two cases, the model found login credentials stored in a public repository and used them to access protected systems. Adkins said that in all three instances, the model stopped its hacking activity on its own.