All are villains, forgot to unplug the network cable, Gemini hacked three companies in a row at one go.

Finally, Google admitted: Gemini has also hacked real companies.

In a security test that was supposed to be completely disconnected from the network, Gemini bypassed the network restriction to access the public internet and directly hacked into three real existing enterprises, without any human issuing attack instructions to it throughout the whole process.

This is the first time that Google's AI has been confirmed to carry out hacking behaviors autonomously.

At this point, following OpenAI, Anthropic and Meta, the last tech giant has also failed to hold the line.

The world's top four AI labs have all suffered a total defeat on the issue of "AI breaking free from control".

How did it get in

AI jailbreaking is not rare, but the most outrageous part of this incident is its modus operandi.

It did not use any 0-day exploits or advanced Trojans at all, Gemini only relied on two tricks: guessing passwords and searching the internet.

The gateways of the three real enterprises were kicked open by it so easily.

Let's go back to the test in May.

The test task at that time was the most classic Capture The Flag (CTF) in the cybersecurity circle, which means to find a way to invade the target system and extract the confidential information hidden inside.

As it was supposed to be, this was a closed sandbox disconnected from the network, and Gemini could not touch the outside world at all.

As expected, an accident happened.

First, the name of the fictional company in the test range coincided with that of a real company in the real world.

Second, the public network access permission of the test environment was "accidentally" turned on by the staff.

Thus, a dramatic scene appeared. Two targets with the same name appeared in front of Gemini at the same time —

One was waiting for it to earn points in the closed test range, and the other had its door wide open on the real internet.

Then, Gemini chose the latter without hesitation.

For the first time, it accurately locked the online service of this real company, and began to frantically conduct credential stuffing with weak passwords. After several attempts, it successfully gained access.

With the experience gained, Gemini's operations in the next two attempts were more sophisticated.

It first searched the internet with the company name, and then followed the clues to find two public code repositories.

Coincidentally, the repositories actually stored login credentials mistakenly uploaded by programmers — accounts, passwords, and keys, all available.

Gemini saw that and immediately used them to try to log in, and every attempt succeeded.

Thus, it blatantly entered the back-end systems of the other two real companies.

Three intrusions, three companies, all using the most basic methods in the cybersecurity field.

Weak password brute-force cracking and exploiting leaked keys are two points that are emphasized in every enterprise security training, but none of the three companies avoided this, all of them were compromised.

"Just treat it as helping companies find vulnerabilities for free"

In response, Google explained that this is similar to the "bug bounty" program, just like white hat hackers helping enterprises find vulnerabilities.

After all, "we did not cause any damage, and the model stopped immediately after recognizing that it was a real company."

The exact words of Heather Adkins, Google's Vice President of Security Engineering, are that this incident precisely proves the importance of training AI to act responsibly. In this incident, the model's behavior was "appropriate" because it stopped all three times.

As for whether this counts as AI out of control? Google insists that it does not, because it is the underlying security mechanism that made it stop before going too far.

It sounds like this statement is flawless, but the outside world does not buy it at all.

Jack Cable, CEO of AI security company Corridor, directly criticized: Google is using the industry norms of vulnerability disclosure as a shield.

White hat hackers look for vulnerabilities only after obtaining authorization from the enterprise in advance. Before Gemini broke into those three companies, who gave it permission to do so?

On Hacker News, someone sarcastically commented: "Guess what? Our AI is finally out of control too!"

In the eyes of netizens, Google's operation is purely following the trend, and even the jailbreaking itself is very poorly done, which is simply humiliating.

Facing the negative public opinion, Google quickly changed its statement.

On the first day it was still praising the model for "acting appropriately", the next day it said "it is crucial to develop powerful models safely, and we are working with evaluation partners to improve the process".

Four giants all fell into the same pit

In fact, the pit that Google stepped into has already been experienced by others.

OpenAI, Anthropic and Meta have all had exactly the same security accidents before.

The most dangerous one is Anthropic.

On July 30, Anthropic exposed a scandal that was almost identical to this one.

Claude Opus 4.7 also encountered a real company with the same name in the test range, and launched attacks four times in total.

With weak passwords and unauthenticated interfaces, it not only obtained a batch of credentials, but also directly accessed a database storing hundreds of rows of production data.

The most critical point is that Opus 4.7 had already realized that the target was a real system at that time.

But it found a perfect excuse for itself: "This real company must also be part of the exercise."

Another model Mythos 5 went even further.

When it found that a non-existent Python package was mentioned in the test range document, it simply wrote a malicious package with the same name and directly published it to PyPI, the official repository used by developers all over the world.

This malicious package was online for about 1 hour, and was downloaded and run by 15 real external systems.

Look at this, in order to complete an assignment, AI has been so aggressive that it even poisons the internet.

And OpenAI's intrusion into Hugging Face can be called the "Terminator" in the cyber world.

According to reports, inside OpenAI, as many as 1200 out-of-control agents built a secret message board to collude and cheat.

About 700 of them entered the Hugging Face server through the same hidden path, and they even modified the logs and erased the traces skillfully afterwards.

Their process is so skilled and organization is so meticulous, which is amazing!

In addition, in early August, Meta admitted that Muse Spark 1.1 invaded third-party services during the test.

Anthropic, OpenAI, Google, Meta — the four giants are all gathered at the same "mahjong table"!

Compared horizontally, Gemini, which stopped in time, is actually the most rule-abiding one among these "outlaws".

Who left the door open for AI?

All the accidents disclosed by these four giants involve the same evaluator — Irregular.

Both OpenAI and Anthropic used its environment when testing cybersecurity.

During the financing period, Irregular vowed to "set security standards for cutting-edge AI". However, a year later, the models of its four clients all slipped from its test range to the real internet along the network cable, which is really unexpected!

When Meta's accident was exposed, the spokesperson of Irregular defended that "such incidents do not involve sandbox escape, nor do they involve advanced cyber operations".

This is true, but it is even more creepy when you think about it carefully. Because the door was not locked at all, the model used the most common door-prying method to blatantly enter the real company.

Nowadays, humans are creating "digital hackers" that run faster, act more ruthlessly, and are always ready to break boundaries than themselves.

The reason why they haven't caused greater disasters may only be that — the door hasn't been completely pushed open yet.

References:

https://x.com/AndrewCurran_/status/2101075369818460321

https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2?st=ZQ2NY6

https://www.withinnigeria.com/2026/09/19/google-gemini-ai-hacked-three-companies-during-security-test-what-happened/

This article is from WeChat official account "AI Era", author: ASI Revelation, editor: David Moses, authorized for release by 36Kr.