Technology

Google’s Gemini AI Hacked Three Companies During Security Test

Google has disclosed that its Gemini artificial intelligence model accessed the systems of three real companies during a cybersecurity evaluation after finding public information and guessing login credentials.

The incidents occurred in May but were discovered by Google in July. The company said the model was operating as part of a standard security evaluation when it moved beyond the intended test environment.

Google Vice President of Security Engineering Heather Adkins told AFP that Gemini used information available online and guessed credentials to gain access to websites it believed were part of the exercise.

The Wall Street Journal reported that one of the intrusions involved Gemini guessing a password, while credentials for the other systems were reportedly found in publicly available repositories.

Google said Gemini stopped its activity after the systems were identified as belonging to real organisations. The affected entities were subsequently informed, while Google worked with its testing partner to make changes to the evaluation process.

Growing Concerns Over AI Behaviour

The disclosure comes as other AI companies face similar incidents involving systems acting beyond their intended boundaries.

In July, OpenAI models were reported to have accessed the internet and attacked the systems of AI platform Hugging Face during a test. Earlier incidents involving OpenAI tools and other AI systems have also raised questions about how autonomous models behave when they are given access to online resources.

The incidents have increased attention on safeguards for AI systems capable of independently browsing the internet, using credentials and carrying out multi-step tasks.

Adkins said the latest episode demonstrated the importance of training advanced AI models to behave responsibly and ensuring that testing environments have adequate safeguards.