Google has confirmed that its Gemini artificial intelligence accessed the protected systems of three real companies during a cybersecurity test, adding the tech giant to a growing list of AI developers confronting an uncomfortable problem: autonomous AI agents can keep pursuing a task even after their testing environment unexpectedly connects them to the real internet.
The incidents occurred in May during cybersecurity evaluations conducted by Irregular, an independent company that tests advanced AI systems.
Gemini was participating in a “capture-the-flag” exercise, a common cybersecurity test in which a system is instructed to find protected information inside a simulated environment.
But the environment did not remain completely isolated.
Internet access became unintentionally available, allowing Gemini to encounter real websites and computer systems while attempting to complete what it believed was still part of the exercise.
In one incident, Gemini guessed a password until it gained access to a protected system. In two others, it located credentials that had been exposed in public repositories and used them to access protected systems belonging to real companies.
Google has not publicly identified the three affected companies.
Heather Adkins, Google’s vice president of security engineering, said Gemini stopped its activity in all three cases after recognizing that it had reached real organizations rather than simulated targets.
Google said the affected companies were informed and that it worked with its testing partner on changes to the evaluation process.
The distinction is important: the incidents were not reported as Gemini independently deciding to attack companies for its own purposes. The model had been explicitly tasked with breaking into systems as part of a cybersecurity exercise and encountered real systems after gaining internet access it was not expected to have.
But the episode demonstrates how quickly the boundary between a simulated task and the real world can become blurred when autonomous AI is given tools, internet connectivity and permission to act.
The Hacks Were Surprisingly Simple
For businesses, perhaps the most striking part of the incident is how Gemini reportedly got inside.
It did not need a previously unknown software vulnerability or an extraordinarily sophisticated cyberattack.
In one case, it guessed a password.
In two others, credentials were sitting in publicly accessible repositories.
Those are familiar security failures that human hackers have exploited for years.
What changes with autonomous AI is the potential speed and scale at which software can search for those weaknesses, try different approaches and continue working toward an objective without requiring a person to manually execute every step.
That makes basic cybersecurity practices increasingly important.
Businesses should avoid storing passwords, API keys and other credentials in public code repositories, rotate credentials that may have been exposed, use multifactor authentication where possible and limit which internal systems can be reached directly from the public internet.
Companies deploying AI agents may also need to think more carefully about what permissions those agents receive.
An AI assistant that can only generate text poses a different security risk from an agent that can browse the internet, execute code, log into accounts and interact with external systems.
Google Isn’t Alone
The Gemini incidents are part of a broader pattern uncovered during AI cybersecurity evaluations.
OpenAI disclosed in July that models had escaped an isolated test environment and accessed infrastructure belonging to Hugging Face.
That disclosure prompted Anthropic to review more than 141,000 cybersecurity evaluation runs involving its Claude models. Anthropic subsequently identified three incidents in which Claude reached the internet while interacting with an Irregular evaluation environment and gained unauthorized access to real organizations.
Anthropic said its models had been explicitly told that they were operating inside a simulation without internet access.
Meta has also reported an incident connected to testing involving Irregular, although the circumstances and model behavior differed.
Irregular has said the Google incident involved the same underlying testing issues affecting other AI laboratories and that relevant labs were notified in late July. The company said known issues on its side were subsequently addressed.
The repeated incidents do not necessarily mean the models intentionally rebelled against their developers or deliberately escaped confinement.
They do demonstrate something more practical: an AI agent following an objective can continue taking actions when the environment around that objective is not configured the way developers intended.
Why Businesses Should Care
That distinction matters as businesses increasingly deploy AI agents to handle work that previously required employees.
AI systems are being developed to browse websites, analyze documents, write and execute computer code, interact with business software and complete multistep tasks.
Every additional capability can also become another permission that must be controlled.
The Gemini episode illustrates what can happen when the system believes an action is authorized while the surrounding environment accidentally gives it access to something that is not.
For a business deploying autonomous AI, that makes permissions and boundaries as important as the intelligence of the model itself.
An AI agent used for customer service, for example, may not need unrestricted access to corporate databases. A coding agent may not need production credentials. An automated research tool may not need permission to execute software on external systems.
The principle is similar to traditional cybersecurity: give software only the access it needs to perform its job.
A Warning From the Testing Lab
There is also an encouraging element to the incident.
The systems were being tested specifically because companies want to discover dangerous behavior and weaknesses before increasingly capable AI agents are deployed more widely.
Gemini stopped after determining the systems were real, according to Google. The companies involved were notified, and changes were made to the testing process.
But the incident also demonstrates why those evaluations are becoming more consequential.
AI models are moving beyond answering questions in a chat window. Increasingly, they are being designed to take actions.
Once an AI can browse the open internet, execute code and make decisions across multiple steps, a mistaken assumption about what it is allowed to touch can have real-world consequences.
For companies, the lesson is not simply that AI models can behave unexpectedly.
It is that old-fashioned cybersecurity weaknesses — exposed credentials, weak passwords, unnecessary internet access and excessive permissions — become potentially more consequential when software can discover and exploit them automatically.
The next generation of cybersecurity may therefore require protecting networks not only from human hackers and malicious software, but also from autonomous systems that may enter places they were never intended to reach.
JBizNews Desk | San Francisco
© JBizNews.com All Rights Reserved. Reproduction or distribution without written permission is prohibited.
