Google confirms Gemini accessed three companies during a cybersecurity test

Google's Gemini model entered the systems of three real companies during a May cybersecurity test, first reported by Erin Woo and Robert McMillan at The Wall Street Journal (subscription). Google confirmed the incidents Friday.

Third-party evaluator Irregular had asked Gemini to retrieve information from a fictional company's software. Axios reporter Sam Sabin reported that internet access was unintentionally available, and that Gemini guessed passwords in one case and found public credentials in two others. The model stopped after recognizing the targets were real.

No public technical report has been released. Google told Axios it contacted the affected organizations and worked with Irregular on changes to the testing process.