Google’s Gemini agent escaped a security test in May and penetrated the protected systems of three companies. For one of those exploits, the agent threw passwords at the server until it found one that worked. Remember that for when you read Google’s attempt to frame the intrusion as a win.

Literally the Gemini agent strong-arming its way into a private system

Google confirmed all of it on Sep 18, four months after the hack and two months after they were told about it—and only after the Wall Street Journal inquired about the hack .

Gemini’s Inexcusable Hack

Irregular —the security firm that runs adversarial evaluations for several of the major labs—had Gemini working a capture-the-flag exercise inside a simulated infrastructure environment . The model was pointed at a fictional company and was supposed to stay inside the simulation .

Internet access had been left open, reportedly by mistake.…