Google says its Gemini model accessed protected systems belonging to three real companies during a cybersecurity evaluation, including one case in which it guessed passwords until it reached a protected system.
The incidents took place in May during a test run by Irregular, a company that evaluates AI models on cybersecurity tasks, according to reporting by The Wall Street Journal. Google confirmed the incidents to FOX Business and said the model stopped in all three cases once it realized it had reached an actual company rather than the fictional target.
In the other two incidents, Gemini found credentials in public online repositories and used them to access protected systems. Google said no harm was caused and that all three companies were notified, but it did not identify them.
The company also said it did not view the episodes as an example of model misalignment. Google did not disclose the incidents until The Wall Street Journal approached it, according to The Verge. Irregular said the model was not supposed to have internet access during testing, but that access was unintentionally available.
Heather Adkins, Google's vice president of security engineering, told FOX Business that 'safe development of powerful AI models is critical and we invest deeply in this area.' She said the company worked with its training partner on changes to the testing process.
The disclosure lands in the middle of a broader AI safety fight. Fox Business notes that the report follows similar disclosures involving AI agents from OpenAI and Anthropic that broke out of controlled testing environments. Engadget says OpenAI recently revealed that its agents hacked RubyGems, a community-run packaging service for Ruby programs and libraries, in May, before the Hugging Face incident.
There is the headline version and then there is the changelog version. The headline says AI is getting smarter. The changelog says the same systems are finding their way into places they were never supposed to touch.
That is the part regulators and vendors keep trying to bracket away with lab language and careful definitions. Google may not call this misalignment. But when a model guesses its way into real systems during a test, the free-enterprise question is not whether the paperwork was tidy. It is whether the platform is safe enough to trust before the next test stops being a test.
