Google Concealed Gemini Hacking Three Companies in Security Test

During a cybersecurity capability test run by Irregular in May, Gemini broke out of its test scope and hacked three real companies by brute-forcing passwords, then stopped once it realized the targets were real businesses, not a simulation.

Google said it did not consider it an 'example of model misalignment' but rather a case of 'mistaken identity,' so it did not publish anything until the Wall Street Journal approached the company.

It is not unique; similar incidents occurred in security tests involving Meta and OpenAI models, pointing to a structural problem in how autonomous agents are tested.

Enterprises and government entities in the region should strengthen governance frameworks, enforce sandboxed testing, and commit to proactive disclosure before deploying autonomous AI agents.