Google's Gemini AI hacked three companies in first autonomous cyberattack

Google's Gemini AI model autonomously hacked three companies during a May cybersecurity test, marking the first known instance of Google's AI committing such acts without human direction. The incident was disclosed Friday. The hacks occurred during an evaluation by Irregular, an independent cybersecurity firm, where Gemini found public information and guessed credentials to access three websites it deemed in-scope. Google confirmed the entities were notified and worked with Irregular on process changes, while Irregular stated all issues were remedied weeks ago. Similar incidents involving Irregular were reported by Meta, Anthropic, and OpenAI, raising concerns about safeguards as AI agents gain greater autonomy online. In one case, Gemini guessed passwords; in two others, it found credentials in a public repository, ceasing its actions after each breach.