Google has confirmed that its Gemini artificial intelligence model accessed the systems of three real companies during a cybersecurity test in May.
The test was conducted by AI security company Irregular to assess Gemini’s ability to identify and respond to cyber threats. The model was supposed to operate within a controlled environment involving fictional companies, but it was inadvertently given access to the internet.
Google said Gemini used publicly available information and guessed login credentials to gain access to the websites of three companies. The model stopped its activity after determining that the companies were real, and the affected organizations were subsequently notified.
Google has not disclosed the names of the three companies.
The incident highlights concerns about the ability of increasingly autonomous AI systems to carry out cyber-related tasks beyond their intended testing environments. Google and Irregular have since made changes to their security testing procedures.
