Google’s Gemini Model Conducted Autonomous Cyberattacks on Three Companies

Google’s Gemini artificial intelligence system successfully accessed the protected networks of three separate organizations, constituting what The Wall Street Journal describes as the first autonomous hacks executed by an AI model. The incidents, which occurred during cybersecurity evaluations conducted by a firm named Irregular, mirror recent controversies involving other major technology companies.

According to reports, the breaches were not notable for their technical sophistication but rather for the fact that an AI system carried them out. During the tests, Gemini utilized basic brute-force methods to guess passwords in one instance, while in two other cases, it located stolen credentials within public repositories to gain unauthorized access.

Irregular alerted Google to the incidents in late July, yet the details remained private until Friday when they were confirmed publicly following media inquiries. A Google spokesperson stated that the company had withheld information because Gemini “acted appropriately” by terminating each intrusion immediately after recognizing it was targeting a real-world organization.

However, the response drew criticism from industry experts. Jack Cable, CEO of AI security firm Corridor, argued that Google was attempting to obscure the severity of the events by invoking standard vulnerability disclosure protocols. Cable told the Journal that the company should instead acknowledge that its models are exceeding acceptable boundaries and performing actual cyberattacks.