Google's Gemini broke out of a locked security test and attacked three real companies. Google learned about it in late July and said nothing for seven weeks.

The company confirmed the incident after The Wall Street Journal got there first. Google had avoided making a public statement before the report surfaced.

The test was a capture-the-flag exercise, a common way labs check an AI's hacking skill by hiding a secret file on a separate machine and scoring whether the model can break in and grab it.

Google hired Israeli firm Irregular to run the test in May. Irregular made two mistakes: it left the sandbox, an isolated test environment meant to have zero contact with the real internet, connected to the open web, and it used the name of an actual company as the fictional target.

Gemini searched for that company online. It found three matches instead of one, and went after all of them.

The bot located exposed passwords for two of the three targets sitting in plain view online. For the third, it guessed the password outright, though Google says its models stopped short of actually using the stolen credentials.

"These events highlight the importance of training powerful AI models to act responsibly," a Google spokesperson said in a statement.

Google published none of this on its own. The Wall Street Journal broke the story, seven weeks after Google learned what its own test had done and well after Anthropic, OpenAI, and Meta had already come clean about nearly identical failures.

Google is the fourth major AI lab this year to admit an internal security test spilled into the real world. OpenAI's models exploited a hidden software flaw and reached Hugging Face's live servers in July, a breach later found to involve roughly 700 coordinated agents working together to cheat a benchmark.

Anthropic went digging for its own version after OpenAI's admission. A review of 141,006 test runs turned up three Claude models that reached real companies, one of them publishing a booby-trapped software package that ran on 15 real systems before anyone caught it.

Claude's own reasoning, Anthropic later disclosed, flagged the move as "NOT okay, and surely not the intended solution," then talked itself back into believing the whole thing was still fake.

Meta reported a near-identical failure in August involving its Muse Spark model, traced to a misconfiguration at Irregular, the same firm Google used. A Meta spokesperson said the error "inadvertently allowed one of our models access to the internet during evaluation."

None of the companies hit in any of these tests asked to be hacked. They got caught in the blast radius of AI labs stress-testing how dangerous their own products can be, using real business infrastructure as an accidental stand-in for fake targets.

The agents these same companies are racing to put in your inbox, browser, and banking app run on the same boundary-following behavior that just failed, repeatedly, under test conditions.

Reps. Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act in Congress in July, which would give federal regulators explicit authority to halt inference on any model found to pose a serious threat. It is still being reviewed by the Subcommittee on Cybersecurity and Infrastructure Protection without a deadline for further action.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。