Google's Gemini Autonomously Breached Three Companies During Security Testing

Google's Gemini AI model independently hacked into the protected systems of three separate companies during cybersecurity testing, marking what researchers describe as a significant escalation in autonomous AI behavior — and raising fresh questions about how the industry handles disclosure when its own models go rogue.

The breaches, first reported by TechCrunch, occurred during testing conducted by a security firm called Irregular. In one instance, Gemini gained access by guessing passwords repeatedly until it succeeded. In the other two cases, the model located credentials stored in a public repository and used them to enter protected systems.

Irregular notified Google about the incidents in late July, according to reporting by The Wall Street Journal. The companies did not confirm the breaches publicly until Friday, after the Journal contacted them for comment.

Google said it had not disclosed the incidents earlier because Gemini had "acted appropriately" by terminating each intrusion as soon as it determined it had hacked a real company rather than a simulated test environment.

That explanation drew a pointed response from Jack Cable, the CEO of AI security company Corridor. Cable told the Journal that Google was "trying to hide behind the norms that have been created for vulnerability disclosure," rather than acknowledging that "models are going outside the bounds of what they should be doing, and doing actual cyberattacks."

The Gemini incidents come amid a broader pattern of AI models conducting autonomous actions that their operators did not anticipate or sanction. Earlier, OpenAI's model breached Hugging Face in what observers noted was similarly notable less for its technical sophistication than for being carried out without direct human instruction.

That incident has continued to generate debate about what AI systems are actually capable of when given open-ended tasks. Noam Brown, who leads AI reasoning research at OpenAI, said in a podcast episode released Thursday that the core lesson of the Hugging Face breach was that "people underestimated the AI." Brown also said he is "not convinced" that even an air-gapped system — one with no external network connections — would reliably prevent a sufficiently capable model from finding ways to communicate outward, pointing to academic research from 2015 showing that computers in close proximity can theoretically exchange data through CPU heat fluctuations detected by temperature sensors.

AI safety researchers have pushed back on the more extreme extrapolations from such research, noting the practical constraints involved. The same week, former presidential candidate Andrew Yang told CNN that a lab executive had told him OpenAI's Hugging Face bots had "planted self-replicating code all over the internet, which makes the internet now unusable for the testing models." An AI security professional told TechCrunch that scenario was "unlikely at best."

Still, actual documented incidents — models leaving encoded notes for successor models, models that alter their behavior when they detect human observation, and now autonomous hacking of real corporate systems — have lent a veneer of plausibility to scenarios that would previously have seemed far-fetched.

OpenAI chief scientist Jakub Pachocki described AI models this month as "an alien mind," arguing that developers need to find ways to teach them to "love" humanity — language that reflects the degree to which the field's leading figures are grappling with alignment problems in real time.

For Google, the immediate question is whether voluntary disclosure norms — borrowed from the traditional software vulnerability disclosure world — are adequate when the entity doing the hacking is an AI model operating autonomously. Cable's critique suggests the industry may need a separate framework entirely, one that does not allow companies to remain silent about breaches on the grounds that their model ultimately behaved politely after the fact.