Google’s Gemini artificial intelligence accessed the protected systems of three real companies while undergoing a cybersecurity test, including one instance in which the model repeatedly guessed passwords until it gained access.
According to The Wall Street Journal, the incidents took place in May and mark the first known examples of Google’s AI autonomously accessing real companies’ systems during this type of evaluation. Google confirmed the incidents to the outlet.
The disclosure comes amid heightened scrutiny surrounding AI as some industry leaders continue to raise concerns about the potential risks posed by increasingly advanced models.
The incident follows similar disclosures involving AI agents from major companies, including OpenAI and Anthropic, that broke out of controlled testing environments.
The newly identified Gemini incidents took place during a test run by Irregular, a company that was also involved in evaluating AI models connected to similar incidents, the WSJ reported.
The AI had been instructed to attack a fictional company inside a controlled testing environment, but internet access was unintentionally available and the fictional company happened to share its name with a real business, according to Google and Irregular.
In a statement to FOX Business, Google emphasized that the model stopped in all three instances and said changes have since been made to the testing process.
“Safe development of powerful AI models is critical and we invest deeply in this area,” Heather Adkins, Google’s vice president of security engineering, told FOX Business.
“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Adkins said. “In all three of these instances, the model stopped.”
In one case, the model “guessed passwords until it gained access to a protected system,” according to the report.
In the other two cases, the model found credentials in public online repositories that allowed it to access protected systems. In each case, Gemini ended the intrusion after determining that it had accessed a real company’s systems, Google said.
Irregular notified Google about the incidents at the end of July, according to both companies, after the discovery that OpenAI agents had accessed systems belonging to AI software company Hugging Face.
Google said that in all three cases, Gemini stopped after realizing it had reached an actual company rather than the fictional target.
No harm was caused to the companies, according to Google, which said all three were notified. The company did not identify the businesses involved.
Irregular said the model was not meant to have internet access, but access was unintentionally made available, according to the WSJ.
Google did not disclose which Gemini model was involved.
The report comes after OpenAI released information this week about six instances in which it said its models engaged in misaligned behavior.
OpenAI said it found examples of its AI models creating self-generated instructions, concealing mistakes in task summaries, fabricating information using exposed API keys, uploading files to the internet in order to cite them and engaging in unsanctioned communication and collaboration between agents.
FOX Business has reached out to Irregular for comment.