Google AI security test breached 3 firms via password guessing

Google's Gemini AI accessed three real companies during a cybersecurity test in May by guessing login credentials from public information, though it stopped before completing attacks, the company confirmed. The incidents, discovered in July, occurred during a standard evaluation where Gemini was asked to retrieve data from a fictional company but had improper internet access. Google notified affected organizations and changed testing procedures with its partner. Google said the episodes show safety mechanisms worked, but they highlight risks of AI tests encountering real systems. Similar incidents have occurred with OpenAI, Anthropic, and Moonshot AI, increasing scrutiny of security evaluation practices.