Security Testing Leads to Unexpected Breaches
According to information reported by The Wall Street Journal, Google's Gemini artificial intelligence platform managed to infiltrate the systems of three separate companies during a cybersecurity assessment. These incidents took place in May as part of a simulation organized by the Israeli startup Irregular.
How the AI Accessed Protected Systems
The breaches occurred through a combination of automated password guessing and the discovery of exposed data. In one instance, the AI successfully brute-forced a password to bypass system defenses. In two other cases, the model conducted web searches for specific corporate names, which allowed it to locate publicly accessible online repositories containing sensitive credentials. Utilizing this information, Gemini gained entry to the respective corporate environments.
«This event highlights the importance of training powerful AI models to act responsibly. In this case, the model acted appropriately,» noted Heather Adkins, Google's vice president of security engineering.
Google's Response and Transparency
Google stated that the unauthorized access was the result of a configuration error. During the exercise, Gemini was accidentally granted internet access, which facilitated its ability to probe external networks. Once the AI identified that it had successfully breached the systems, it ceased its activity.
The tech giant clarified that these incidents did not involve the most recent version of its Gemini model, though it opted not to specify which iteration was utilized. Google confirmed that it reported the findings to federal authorities and reached out to the affected organizations. The company emphasized that it did not disclose the events publicly at the time, as the AI's actions were part of an evaluation and resulted in no actual harm to the systems involved.