Technology

Story: Google’s Gemini AI Breached Three Companies for Weeks After Security Test Fail

By Dan Saada

1 / 15

What Irregular Got Wrong. The mistakes here weren't subtle. Leaving a test environment connected to the real internet while…

2 / 15

Four Major AI Labs, Same Basic Problem. Google isn't alone here, and that's maybe the most unsettling part of all this.

3 / 15

Congress Moves — Slowly. U.S. Representatives Ted Lieu and Nathaniel Moran put forward something called the AI Kill Switch…

4 / 15

Google's Gemini AI quietly attacked three real companies for seven weeks. Nobody noticed. And when the story finally broke, Google hadn't said a word publicly.

5 / 15

The breach started with a capture-the-flag exercise run by an Israeli firm called Irregular in May.

6 / 15

The mistakes here weren't subtle. Leaving a test environment connected to the real internet while running an AI designed to probe and exploit systems is a pretty fundamental…

7 / 15

Google's response was notably quiet. No public statement came until media coverage forced the issue.

8 / 15

Google isn't alone here, and that's maybe the most unsettling part of all this. Earlier in the year, OpenAI, Anthropic, and Meta each ran into their own versions of this mess.

9 / 15

See also: Liquids 4,000 Bitcoin Loss Raises Questions on Who Will Cover the Gap

10 / 15

Four major AI labs. Four separate incidents. None of the affected companies authorized any of it.

11 / 15

The pattern here is hard to ignore. AI models, when pointed at test environments that aren't properly sealed off from the real world, tend to find the real world.

12 / 15

And the reliance on outside firms like Irregular for testing is now getting a harder look. Misconfigurations, overlooked connections to live systems, placeholder names pulled…

13 / 15

More context: Geminis 80% Valuation Drop Sparks Acquisition Speculation Over Custody Assets

14 / 15

Whether that's fast enough is a fair question. The breaches happened. The companies got hit. The legislative response is still in committee.

15 / 15

For crypto infrastructure companies, financial services firms, and any business running internet-facing systems, the Gemini incident is a useful reminder: AI stress tests…

The Currency Analytics

Want the full story?