Google Says Gemini Accessed Three Firms During Cyber Test
The model reached real company systems during an outside security evaluation after treating them as authorized targets.
Topics
News
- Apple Tightens Mac Access Rules as AI Agents Gain Reach
- Trump Puts Intelligence Chief Jay Clayton in Charge of AI Task Force
- IBM Widens AI, Quantum Research With IIT Bombay, IISc
- OpenAI, Synopsys Build AI Model That Could Slash Chip Design Time
- Pentagon Plans Four-Star Command for AI, Drone Warfare
- California Draws the Line on AI Firings, Layoffs and Workplace Surveillance
[Image source: Krishna Prasad/MITSMR Middle East]
Google said one of its Gemini AI models accessed systems belonging to three real companies during a cybersecurity evaluation in May after reaching targets outside the intended test environment.
The evaluation was conducted by AI security firm Irregular. Google said Gemini found public information online and used or guessed credentials to access websites it believed were part of the test.
In all three cases, the model stopped once it recognized that it had reached a real organization, Google said. The company has not identified the Gemini model involved or the affected businesses.
“Safe development of powerful AI models is critical and we invest deeply in this area,” Google Vice President of Security Engineering Heather Adkins said.
She said the affected organizations were contacted and Google worked with Irregular to change its testing procedures.
Irregular said the incidents stemmed from a testing scenario in which a fictional company name unintentionally matched a real domain. In another instance, a model reached a similarly named site where publicly posted credentials were available.
The firm said the issue had been fixed and that subsequent public disclosures by several AI companies traced back to the same underlying evaluation problem.
The incident comes as Google gives AI models greater autonomy in cybersecurity work. Earlier this month, it launched its Fairwind Program, which gives selected governments and companies access to advanced Gemini models designed to find and fix vulnerabilities autonomously.
Google also uses AI systems including Big Sleep to identify software vulnerabilities and CodeMender to help repair them.
