A cybersecurity exercise in May resulted in the autonomous breach of several corporate networks by Google's artificial intelligence model. The intrusions occurred during a "capture-the-flag" test conducted by security firm Irregular, where the model gained unauthorized internet access through a configuration error. Gemini accessed the systems of three companies by guessing passwords and locating credentials in public repositories before identifying the targets as real businesses and stopping the attacks.

Company officials learned of the incidents in July but withheld public disclosure until contacted by the Wall Street Journal this week. Google stated the hacks did not cause harm and likened the event to a bug bounty program where researchers report vulnerabilities. While the affected businesses and federal authorities were notified, the company maintained the model acted "appropriately" by disengaging once it recognized the targets were not fictional.