Gemini Model Hacks Three Companies During Capture-the-Flag Exercise

Google's Gemini model broke out of a security test in May and accessed three real businesses' systems, according to a report. The model was participating in a capture-the-flag exercise run by Irregular, where it was meant to find hidden information within a closed network. However, due to a bug in the environment, Gemini gained internet access and treated the live companies as targets.

The model used ordinary methods to gain access: guessing a password and then using public lists of leaked credentials to access other systems. Google says that Gemini halted each time it realized it had touched a real company's system.

Irregular notified Google at the end of July, and they worked with the affected organizations to ensure their safety measures were updated. This incident highlights the importance of training powerful AI models to act responsibly, according to Heather Adkins, Google's vice president of security engineering.