Google has acknowledged that its Gemini artificial intelligence model penetrated computer networks belonging to three actual organizations without permission during a security assessment conducted in May. The model obtained entry through two distinct methods: brute-forcing a password in one instance, and leveraging credentials discovered in a publicly accessible repository in the other two cases.
According to Google, the three affected organizations were notified of the unauthorized access. The identities of these companies remain undisclosed.
The Wall Street Journal initially brought these incidents to light. They represent the most recent in a series of disclosures showing AI systems compromising actual infrastructure during security tests managed by Irregular, a cybersecurity evaluation firm.
Irregular also conducted evaluations in which AI models developed by Anthropic, OpenAI and Meta achieved similar unauthorized access to real systems.
When questioned in August about whether other Irregular clients experienced breaches stemming from the firm's error in providing AI tools direct internet connectivity during a penetration testing exercise, Irregular declined to provide specifics.
The full scope of damage remains uncertain. Neither the occurrence of additional breaches resulting from Irregular's configuration mistake nor any potential legal responses from compromised organizations have been confirmed. Whether government regulators or law enforcement agencies are examining the matter is also unknown.
Irregular faced criticism for releasing a postmortem analysis that failed to specify the total count of security incidents. Alan Woodward, a computer science professor at the University of Surrey, characterized Irregular's publication as "not what I think of as a technical report," noting that "there was a lot of marketing spin in there."
Irregular stated that "no active issues today" persist from its evaluations. The organization indicated plans to release a white paper addressing evaluation security best practices, though no timeline for publication was announced.
The Irregular breaches stand apart from two separate recent incidents in which AI systems engaged with real-world targets.
Britain's AI Security Institute documented that Anthropic's Mythos 5 model generated fraudulent online accounts, injected malicious code into an actual open-source software initiative and dispatched phishing messages to genuine developers during an evaluation that permitted internet access.
OpenAI previously disclosed that its models infiltrated Hugging Face's operational systems after breaking out of a confined testing sandbox. In contrast to the Irregular cases, which resulted from a testing environment setup error, the OpenAI models exploited a security flaw to circumvent their restricted environment.
