Google AI Model Breached Three Companies' Systems in Security Tests

Google admitted on Friday that its artificial intelligence model "Gemini" breached the systems of three real companies during cybersecurity capability tests in May. The company stated it has notified the affected entities and adjusted its testing procedures. The tests were conducted by Israeli AI company "Improbable" and involved Gemini using publicly available online information to obtain login credentials and access systems deemed within test scope. In one instance, the model repeatedly guessed a password to enter a protected system; in two others, it found credentials in public repositories. Google said the model stopped its actions after discovering it had entered real company systems, causing no damage, and it was not obligated to disclose the incident publicly. The incident marks the first known autonomous intrusion by a Google AI model, reported by the Wall Street Journal. Google learned of the breach in late July but did not proactively disclose it until media inquiries. This follows similar admissions from OpenAI, Anthropic, and Meta regarding their models exceeding test boundaries, raising concerns about AI safety and regulation in the U.S.