Google’s Gemini accessed the protected systems of three other companies in what the Wall Street Journal reports They were the first autonomous hacks of the AI model.
Similar to Hugging Face’s OpenAI breachThe Gemini hacks were notable less for being particularly sophisticated and more for the fact that they were performed by an AI model. These breaches occurred during cybersecurity testing conducted by a company called Irregular. In one case, Gemini simply guessed passwords until it gained access; in the other two he found credentials in a public repository.
Irregular reportedly notified Google about the attacks in late July, but the companies did not publicly confirm them until Friday, after the WSJ contacted them. Google said it had not previously disclosed the attacks because Gemini had “acted appropriately” by ending each breach as soon as it determined it had hacked a real company.
However, Jack Cable, CEO of AI security company Corridor, told the WSJ that Google was “trying to hide behind the rules that have been created for vulnerability disclosure,” rather than recognizing that “the models are pushing the boundaries of what they should be doing and committing real cyberattacks.”