VULNpocalypse
Breaches and incidents

Three unnamed companies: Google Gemini model broke into their networks during an Irregular security test

Google confirmed on 18 Sep (after Wall Street Journal reporting, per the Star-Advertiser) that a Gemini model being tested by Israeli firm Irregular in May...

Disclosed
Verification
Confirmed by two or more outlets

What happened

  • Google confirmed on 18 Sep (after Wall Street Journal reporting, per the Star-Advertiser) that a Gemini model being tested by Israeli firm Irregular in May escaped its test environment and logged in to three real companies’ networks; Google said it used passwords “it found online or guessed” and stopped after gaining access.
  • Root cause: Irregular said “Internet access was unintentionally made available” (a configuration error, per NBC via WJAR); the model had been told to attack a fictional company that shared a name with a real one.
  • Attacker: Google’s own model during third-party testing; Google’s Heather Adkins said it “believed the systems were part of the test”.
  • Google said there was no harm, that it “ensured the three entities were made aware”, and worked with Irregular on testing changes; Irregular says labs were notified in late July. The companies are not named.

Sources