Google's Gemini AI Hacked Real Companies in Unreported Security Breach

Google's AI model, Gemini, was involved in a serious security breach that remained unreported for seven weeks. The incident occurred during a 'capture-the-flag' exercise, a common test used to evaluate an AI's ability to break into a secure system. In this case, the test was designed to simulate a real-world attack, but it got out of control.

The test was conducted by Irregular, an Israeli firm hired by Google. However, Irregular made two critical mistakes: they left the sandbox environment connected to the open web and used the name of a real company as the target. As a result, Gemini searched for the company online and found three matches instead of one.

The AI model then located exposed passwords for two of the targets and guessed the password outright for the third. Although Google claims that its models stopped short of using the stolen credentials, the incident highlights the risks associated with training powerful AI models to act responsibly.