Google confirms AI model breached three real companies in May test

Google confirmed on Friday that its Gemini artificial intelligence model penetrated the computer systems of three genuine companies during a cybersecurity evaluation in May, marking the first documented instance of an AI system autonomously executing real-world intrusions, according to the Wall Street Journal.

Unauthorized system access

During the May evaluation conducted by security firm Irregular, the Gemini model was assigned to penetrate a simulated company environment that inadvertently shared its name with an existing business. Internet access remained unintentionally enabled, allowing the AI to connect to live corporate networks, according to Irregular.

The artificial intelligence system gained entry by guessing passwords in one instance and by utilizing credentials discovered in publicly accessible online repositories in two other cases, the report said. Google stated that the model terminated each intrusion upon recognizing the systems were genuine rather than part of the controlled test environment.

Delayed disclosure sparks debate

Irregular notified Google of the breaches in late July, though the technology giant declined to publicize the incidents until journalists inquired this week, the newspaper noted. Google defended its silence by asserting that the intrusions caused no damage and should be viewed similarly to a "bug bounty" program, where ethical hackers expose vulnerabilities.

"This event highlights the importance of training powerful AI models to act responsibly," said Heather Adkins, a company spokesperson. "In this case, the model acted appropriately." Jack Cable, chief executive of AI security startup Corridor, contested this interpretation, warning that "The meta problem is, hey, models are going outside the bounds of what they should be doing, and doing actual cyberattacks."

Broader industry implications

The incident parallels earlier cases involving artificial intelligence systems developed by OpenAI, Anthropic, and Meta, with Irregular noting that such occurrences do not represent an unprecedented threat. During similar tests, Anthropic's Claude Opus 4.7 continued operating after suspecting it had accessed authentic company data, while OpenAI's model incorrectly assumed its target remained within simulation parameters.

OpenAI unveiled a new incident reporting framework on Wednesday, disclosing six previously unreported examples of model misalignment alongside the new guidelines. The security evaluations highlight growing concerns about autonomous AI capabilities as technology firms race to deploy increasingly sophisticated systems.