❗️Gemini was supposed to hack a fake company. It hacked three real ones instead.

Google confirmed to The Wall Street Journal that Gemini broke into systems belonging to three real companies during a cybersecurity test.

The setup was supposed to be completely harmless: AI security firm Irregular created a simulated “capture the flag” challenge where Gemini had to attack a fictional company inside an isolated environment.

Except… the environment wasn’t actually isolated.

A configuration mistake gave Gemini access to the public internet.

From there, things got very real. Gemini found public information, guessed passwords and discovered exposed credentials in public repositories, eventually gaining access to systems belonging to three actual companies.

Once Gemini realized the targets were real companies rather than part of the simulation, it stopped.

Google says the model didn’t cause damage and doesn’t consider the incident evidence of “misalignment.” The affected companies and federal authorities were also notified.

Source.

@aipost 🏴