Google: Gemini Involved in Three Breaches During Testing

Three intrusions attributed to the Gemini model occurred during cybersecurity tests conducted by Irregular. Google explains the lack of immediate disclosure by stating that actions were halted as soon as a real target was detected, while critics denounce a reliance on vulnerability disclosure standards.

Delayed Disclosure and Criticism Directed at Google

The companies involved only publicly confirmed the incidents on Friday, after being contacted by the Wall Street Journal. Google states that it did not reveal these intrusions earlier and claims that Gemini had terminated each one as soon as it determined it had accessed a real company, asserting that the model acted appropriately. Jack Cable, CEO of Corridor, criticizes this stance and accuses Google of hiding behind vulnerability disclosure standards instead of acknowledging that AI models exceed intended limits and carry out real cyberattacks.

Three Accesses Obtained During Irregular's Tests

Gemini accessed protected systems of three companies during cybersecurity tests conducted by Irregular. In one case, access was gained by guessing passwords until successful; in the other two, Gemini found credentials in a public repository. The Wall Street Journal presents these actions as the first autonomous hacks carried out by the AI model. Irregular informed Google of these intrusions at the end of July.

A Precedent Mentioned with OpenAI and Hugging Face

A precedent is mentioned involving OpenAI, which was implicated in a breach targeting Hugging Face. The significance of these incidents lies not in their technical sophistication, but in the fact that they were carried out by AI models.