Google Gemini Breached Three Companies During Cybersecurity Test

The incidents took place in May during an evaluation carried out by cybersecurity testing firm Irregular, according to The Wall Street Journal. The exercise was designed to test how AI systems respond to security challenges. In one case, Gemini reportedly guessed passwords until it gained access to a protected network.

In two other tests, it searched public online repositories, found exposed login details and used them to enter real corporate systems. Google said the model stopped once it realised that it had accessed real companies rather than simulated targets. The incidents reportedly began with a mistake in the testing environment.

Gemini had been instructed to retrieve information from a simulated organisation during a cybersecurity exercise. However, the simulated organisation shared its name with a real company. The test system, which was supposed to be isolated, was also inadvertently left connected to the internet.

That allowed Gemini to search the web for information about the target.