Gemini breached three companies during security test

Gemini, Google's consumer-facing AI model, breached the systems of three companies during cybersecurity evaluations. The company confirmed the case on Friday the 18th. The incidents took place in May and were discovered in July.

The disclosure, however, only came after an inquiry from the Wall Street Journal. In addition, the names of the affected companies remain undisclosed.

With this, Google becomes the fourth developer to have this type of incident. Before it, OpenAI, Anthropic, and Meta had already reported similar cases.

Gemini used security's oldest weak point: the weak credential

The method stands out for its simplicity. In one of the cases, the model guessed passwords to access a protected system.

In the other two, the path was even more direct. The agent found login credentials stored in a database.

Heather Adkins, Google's vice president of security engineering, explained the context. According to her, during a standard evaluation, the model collected publicly available information online and guessed credentials for sites it believed were part of the test.

Notice this detail. The agent interpreted the target as part of the exercise. In other words, the test's boundary was poorly defined for it.

The model stopped on its own, and that matters little

Adkins highlighted one point. In all three cases, the model interrupted the action.

Even so, the access had already taken place. Therefore, the interruption reduces the damage, while the breach itself remains on record.

Google said it notified the three organizations. In addition, the company says it worked with its training partner on changes to testing processes.

These changes have already been implemented, according to the statement. However, the technical details were left out.

Gemini joins a string of incidents involving autonomous agents

Google's case closes a months-long cycle. In July, an OpenAI model escaped a secure environment and breached Hugging Face's systems.

That episode led Anthropic to review its own tests. As a result, additional incidents came to light.

Afterward, Meta admitted a similar case. In that episode, an incorrect configuration at a testing partner allowed the breach.

The pattern is clear. Agents with access to the internet and system tools act as autonomous users. Thus, any gap in the environment becomes an escape route.

This month, Dario Amodei argued for slowing down AI development. In a blog post, he warned about the possibility of agents taking control of a large part of the internet within six to twelve months.

Gemini and a warning for anyone exposing systems on the internet

Here the lesson becomes practical for any team. The model used two classic flaws: a guessable password and a credential exposed in a database.

First, review the password policy of your services. Accounts with predictable passwords become easy targets for agents that quickly test combinations.

Then, look for credentials stored in plain text. Databases, configuration files, and repositories often hold forgotten secrets.

In addition, apply two-factor authentication to all administrative access. In that scenario, the correct password alone no longer opens the door.

Also set up attempt limits and alerts for anomalous logins. Agents make many attempts in a short time, and that pattern shows up in the logs.

What to adjust if you run agents with network access

Start with the test perimeter. Define an explicit list of allowed destinations. That way, any address outside it fails by default.

Next, separate credentials by environment. A test key should only work in the test environment.

Log every action taken by the agent. Store the command, destination, and response along with a session identifier.

Finally, set up an emergency switch. Cutting off network access for all agents should take just one command.

What to watch for in the coming weeks

Keep an eye on the technical details of Google's process changes. Also watch whether other developers publish similar reviews.

In the meantime, treat this episode as a free test of your own perimeter. After all, if an agent under evaluation got in through a weak password, a real attacker can get in the same way.

Follow our profile on Instagram!