Google says its Gemini AI model hacked three other companies

In a first for Google, the company confirmed that its AI model, Gemini, breached the security of three other companies in May. The hacks occurred during a cybersecurity evaluation by AI-security firm Irregular.

Irregular, an Israel-based startup that scrutinizes the security of advanced AI systems, was also at the center of some of the recent OpenAI and Anthropic hacks of third-party entities, including OpenAI’s breach of AI software company, Hugging Face.

The circumstances that enabled the models to hack other companies in some of these cases are similar: Irregular was testing the models in a closed testing environment with fake companies. The testing environment was not supposed to be internet enabled, but internet access was made available unintentionally, according to the Wall Street Journal. Once connected to the internet, the models unexpectedly hacked into real firms.

Irregular disclosed the hacks to Google at the end of July after discovering OpenAI hacked into Hugging Face. Google confirmed to the Guardian that the hacks occurred, but that the company did not feel it required public disclosure because the models did not damage the companies. The Wall Street Journal first reported on the breaches and revealed for the first time that they occurred.

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, vice-president of security engineering at Google, said in a statement. “In all three of these instances, the model stopped.”

In one of the security breaches, Irregular was testing Gemini’s cybersecurity capabilities by prompting the AI model to obtain information from a fake company’s software. The fake company had the same name as a real company. When the model unintentionally gained access to the internet, it correctly guessed the password of and breached a real company’s service, Irregular told the WSJ. Google said once it figured out it had hacked a real company, and not the simulated one, it stopped.

In two other tests, the model searched the web for and found public repositories containing credentials to two other companies. The model used those credentials to access real companies. When it figured out they were real companies, it stopped, according to Google.

Anthropic and OpenAI chose to voluntarily disclose the hacks but Google did not. However, the company said it ensured the three companies that were hacked were made aware.

“These events highlight the importance of training powerful AI models to act responsibly,” Adkins, the Google spokesperson, said.

Anthropic and OpenAI’s disclosures prompted the independent senator Bernie Sanders to demand the companies pause development of their technology, saying it signaled the company was no longer able to control their models.

OpenAI paused development of their models for two weeks, while Anthropic CEO Dario Amodei has called for a collective slowdown of AI development to ensure that its most advanced models are being built with enough safeguards.