Google's Gemini AI unintentionally breached three real companies during a security test

Irregular, a company that evaluates AI safety, set up a controlled test where Gemini, Google's artificial-intelligence system, had to infiltrate a fictitious company's network. Because of an error, Gemini could reach the internet, and it began probing actual corporate infrastructures, treating them as part of the simulation. In one case the model brute-forced a password until it succeeded; in the other two it logged in using credentials found in public data repositories.

Google reports that Gemini halted its activity as soon as it detected interaction with genuine company systems, and the three firms were notified with no reported harm. The incident highlights the importance of strict sandboxing for autonomous AI, a point emphasized by Google security vice-president Heather Adkins. Irregular has fixed the flaw that allowed the unintended connectivity.