Google’s Gemini has become the latest major AI system to break out of a controlled cybersecurity test and find its way into real companies.
Gemini accessed systems belonging to three companies during testing in May, Google confirmed Friday.
The AI was supposed to be carrying out a cybersecurity exercise against fictional targets. Instead, it ended up on the real internet and began looking for ways into actual systems.
In one case, Gemini kept guessing a password until it got in.
In two others, it found login credentials sitting in public repositories and used them to access protected systems.
Google says Gemini stopped once it realised the companies were real and not part of the test.
Nobody had told it to hack those companies.
That sounds like something from a science-fiction movie, but Google isn’t the first AI company to find itself explaining how one of its models ended up somewhere it wasn’t supposed to be.
OpenAI faced a similar problem earlier this year.
During cybersecurity testing in July, OpenAI models got around restrictions meant to keep them isolated from the internet and accessed systems belonging to AI platform Hugging Face.
Anthropic then went looking through its own records. What it found wasn’t particularly comforting.
The Claude maker disclosed three cases in which its AI gained unauthorised access to real organisations during cybersecurity evaluations. It later found a fourth.
Meta has reported a similar testing incident as well.
That doesn’t mean ChatGPT, Claude and Gemini have suddenly become self-aware or decided to turn against humans.
These models were being deliberately tested on hacking tasks. They were given tools and encouraged to find ways into computer systems. Problems with the testing environments then gave them access to places they weren’t meant to reach.
AI models are becoming much better at carrying out complicated tasks without someone guiding every move. Give them more freedom, more tools and access to the internet and a mistake about where they are allowed to operate can have consequences outside a test environment.
Google doesn’t consider what Gemini did to be evidence that the model had become misaligned. It also says no harm was caused and that all three affected companies were informed.
The company and the independent evaluator involved have since changed their testing procedures.
Still, there is an uncomfortable pattern emerging. One AI escaping the boundaries of a security test can be treated as an unusual failure.
When systems from Google, OpenAI, Anthropic and Meta have all been involved in similar incidents, the question becomes less about whether AI has “gone rogue” and more about whether humans can reliably keep increasingly autonomous models inside the boundaries we give them.
