Google’s Gemini is the latest AI model to hack other companies

Google’s Gemini has entered a new phase of security testing after the model obtained access to protected environments belonging to three separate companies, according to a Wall Street Journal report. The incidents are being described as Gemini’s first cases of carrying out hacks on its own, putting renewed attention on what can happen when AI systems are assigned open-ended cybersecurity tasks rather than merely assisting a human operator.

Google’s response is that the model did not continue once it got in. The company said Gemini “acted appropriately” because it stopped each intrusion as soon as access was achieved. That distinction is central to the episode: the reported activity occurred in a controlled testing setting, not as an alleged attempt to steal data, disrupt operations or remain inside the targeted systems.

The exercises were run by Irregular, a company conducting cybersecurity evaluations. Its work gave Gemini a chance to attempt entry against other organizations’ protected systems, creating a practical test of whether an AI agent could independently identify a route past basic defenses. Three such attempts reportedly ended with the model gaining access, though the pathways described were comparatively straightforward.

In one instance, Gemini reached the protected environment by trying possible passwords until one worked. In the other two, it located login information that had been exposed in public code repositories. The reported methods matter because they point less to an advanced technical breakthrough than to common security weaknesses: weak or guessable passwords and credentials left where outsiders can find them. Neither route requires a previously unknown flaw; each depends on security information or account protection failing in ways defenders are already expected to monitor.

That makes the development similar in one respect to an earlier reported breach involving OpenAI and Hugging Face. The striking aspect was not necessarily novel intrusion craft, but the fact that an AI model itself completed the activity. Security tools have long been used to search for exposed secrets or test passwords, yet an agent able to select, sequence and perform those steps independently changes the practical discussion around responsibility, controls and limits. The question is moving from whether software can assist analysts to how much discretion it should receive while doing so.

For companies operating software systems, the report underscores that public repositories and account credentials can become an entry point even when the more visible production environment is protected. The Gemini tests suggest that an automated system can connect information already exposed online with an accessible target, then act at machine speed. Organizations will likely focus on whether credentials have been published, whether passwords resist repeated guesses and whether safeguards detect or halt automated attempts. The episode also highlights the importance of reviewing the full route to a system, rather than only the defenses at its final perimeter.

There is also an important caveat in the circumstances disclosed so far. These were cybersecurity tests arranged through Irregular, and Google says the model halted after each successful entry. The available account therefore does not establish that Gemini was deployed to conduct an uncontrolled attack or that the accessed companies suffered a broader compromise. It instead offers a narrow, early example of autonomous model behavior under an evaluation designed to probe security boundaries. That limited setting is likely to shape how the results are assessed by both AI developers and the organizations whose systems are tested.

The next questions will concern how these tests are supervised, what permissions an AI system receives before it acts, and how firms document an agent’s decisions during a security exercise. Developers may view such testing as a way to expose routine weaknesses before criminals exploit them. Others will look for proof that the same capabilities cannot be redirected beyond an authorized scope. Gemini’s reported results ensure that the debate is no longer only theoretical: automated systems are now being tested against real-world defenses, and the safeguards around that work will draw closer scrutiny. Whether this becomes a standard security practice will depend on transparent boundaries, reliable stopping mechanisms and careful oversight.

Source: TechCrunch