Google Gemini AI Model Conducts Autonomous Cybersecurity Tests on Company Systems

Google’s Gemini AI model reportedly accessed protected systems belonging to three companies during cybersecurity testing, marking one of the first publicly reported cases of the model independently carrying out successful breaches.

According to The Wall Street Journal, the incidents took place during security evaluations by cybersecurity company Irregular. In one case, Gemini reportedly gained access through repeated password attempts, while in two others it found credentials exposed in public repositories.

AI Security Risks Draw Attention

The incidents were not considered highly sophisticated attacks, but they drew attention because an AI model took actions that resulted in unauthorised access. Irregular notified Google in late July, and the company later confirmed the incidents after media inquiries.

Google said Gemini stopped its activity after determining that it had accessed real company systems. The company said the model acted appropriately by ending the process once it identified the situation.

The reports have renewed discussions about how to control AI systems as they gain more autonomous capabilities. Security researchers continue to examine ways to ensure AI tools can support cybersecurity work without creating new risks.