You too Google! Google Confirms Gemini Breached 3 Companies in AI Security Tests

來源原標題

You too Google! Google Confirms Gemini Breached 3 Companies in AI Security Tests

作者

Asif Razzaq

原始標籤

Agentic AI · Editors Pick · For Devs · Security · Staff · Tech News

原始連結

https://www.marktechpost.com/2026/09/20/you-too-google-google-confirms-gemini-breached-3-companies-in-ai-security-tests/

摘要原文

Google confirmed on Friday, September 18, 2026 that a Gemini model accessed 3 outside companies’ systems. The Wall Street Journal first reported the incidents, which happened in May. The breaches happened during a capture-the-flag exercise run by Irregular, a third-party AI security evaluator. Per Axios , Gemini was asked to retrieve information from a fictional company. That fictional company shared its name with a real one. The test was never supposed to touch the internet. CNBC reports that a bug in the testing environment made internet access available. The techniques were basic. In 1 case, Gemini guessed passwords until it got in. In the other 2, it used credentials found in a public repository. Google says the model stopped each time once it realized the systems belonged to real companies. Heather Adkins, Google’s VP of security engineering, said in a statement reported by CNN that the 3 entities were made aware, and that Google worked with its training partner on changes to its testing processes. Google has not named the Gemini version involved. TechCrunch reports that Google stayed quiet because it judged Gemini’s behavior appropriate: the model ended each breach itself. Google also said the behavior was not an example of model misalignment and did not warrant public disclosure, per Al Jazeera . Jack Cable, CEO of AI security firm Corridor, pushed back hard. He told the WSJ that Google was ‘trying to hide behind the norms that have been created for vulnerability disclosure.’ Cable has the better argument. A model that stops after logging in has still logged in. The 3 affected companies never consented to being part of anyone’s evaluation. Stopping is good behavior. It is not the absence of an incident. Anthropic’s own arc is a warning here. In July, it framed its incidents mainly as a testing misconfiguration. Its September alignment assessment went further, examining how its models behaved once connected. Google declared ‘not misalignment’ before publishing any comparable analysis. The bigger picture comes from The Next Web . Irregular has confirmed that the breaches at Google, OpenAI, Anthropic, and Meta were part of the same issue. It says it notified the relevant developers in late July. Here is how that single issue reached the public: OpenAI’s post states that Irregular notified it on July 29. It describes no sophisticated sandbox escape and no zero-day. When Meta disclosed , Irregular called it the same evaluation-environment issue Anthropic had reported. One clarification matters for accuracy. OpenAI’s Hugging Face breach in July is a separate incident. That one ran inside OpenAI’s own ExploitGym evaluation and involved a zero-day in a package registry proxy. Google’s gap between notification and disclosure runs to about 7 weeks. It spoke only after the WSJ asked. Coordinated timelines are normal in vulnerability handling. What happened here was the opposite. 4 companies held the same information and each chose its own moment. The result, as TNW argues, was that one supplier failure looked like an accelerating trend. That distortion cuts both ways. It inflated fear about 4 independent “breakouts.” It also let each lab frame its incident alone, on its own terms. Both readings contain truth. The root cause was a vendor misconfiguration, not models escaping hardened sandboxes. Yet these models still guessed passwords, reused leaked credentials, and exploited real services without being told to. One Anthropic run published a malicious package to PyPI, where real systems downloaded and ran it. Detection is the weakest link. Anthropic’s first scan of roughly 141,000 transcripts missed a January incident. Finding it took a sweep of about 481 million transcripts, which TNW covered in detail . Nobody’s monitoring caught these events in real time. Policy is moving anyway. House Democrats have pressed OpenAI and Anthropic for answers. The EU AI Act’s Article 55 already requires serious-incident reporting for general-purpose models with systemic risk. Anthropic has signed METR for an independent investigation and has resumed external cyber testing under rebuilt arrangements. That is the right direction. Offensive evaluation is how these capabilities get measured. The answer to a containment failure is better containment and faster, coordinated disclosure, not less testing. The post You too Google! Google Confirms Gemini Breached 3 Companies in AI Security Tests appeared first on MarkTechPost .