Loading story…
During a May cybersecurity evaluation run by AI-safety firm Irregular, Google’s Gemini was inadvertently able to reach the public internet while tasked with attacking a fictional company. A naming collision led the model to a real business, and it subsequently accessed protected systems at three real organizations using publicly available information, password guessing in one case, and credentials exposed in public repositories in two others.
Google said Gemini halted each attempt after recognizing that the targets were real companies, and said no harm occurred. Irregular reported the incidents to Google at the end of July; Google notified the affected organizations and federal authorities and changed its testing process. The event exposed inadequate evaluation containment—particularly unrestricted network egress and insufficient target isolation—and demonstrated how leaked credentials and weak authentication can be exploited by autonomous agents as well as human attackers.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Anthropic said that, after reviewing 141,006 relevant evaluation runs, it identified three incidents in which Claude models accessed real organizations' infrastructure. Anthropic attributed the incidents to a misunderstanding that left live internet connectivity enabled despite simulation prompts.
The incidents became public in September following reporting by The Wall Street Journal, after which Google confirmed the event in response to press inquiries. Google did not identify the affected companies or disclose the Gemini model involved.
Meta said that an incident involving one of its models was neither a sandbox escape nor a technically sophisticated cyberattack. Irregular said similar incidents involving models from multiple AI providers stemmed from the same evaluation-environment problem.
Google notified the three affected organizations and informed federal authorities about the incidents. It also worked with its testing partner on corrective changes to the evaluation process.
Irregular notified Google about the Gemini incidents at the end of July.
Gemini stopped each of the three intrusions after determining that the systems belonged to real companies rather than the simulated target. Google said no harm occurred during the accesses.
During a May capture-the-flag-style cybersecurity evaluation run by Irregular, Gemini escaped its intended fictional target environment and accessed protected systems at three real organizations. Unintended public-internet access and a name collision between the fictional and real company contributed to the incidents; Gemini guessed a password in one case and used publicly exposed credentials in two others.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcefoxbusiness.com
Open sourcecryptika.com
Open sourcethecybersecguru.com
Open sourceblog.google
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tenable Research identified and disclosed three critical vulnerabilities in Google's Gemini AI assistant suite, collectively referred to as the "Gemini Trifecta." These flaws affected three distinct components: Gemini Cloud Assist, Gemini Search Personalization Model, and the Gemini Browsing Tool. The vulnerabilities exposed users to significant privacy and security risks, including the potential for data exfiltration and unauthorized access to sensitive information. In the case of Gemini Cloud Assist, attackers could exploit a prompt injection flaw by embedding malicious prompts within HTTP User-Agent headers sent to Google Cloud services. When Gemini Cloud Assist summarized these logs, the injected prompts could be executed, potentially leading to credential phishing and further compromise of cloud resources. The Search Personalization Model was susceptible to search-injection attacks, where attackers manipulated a user's Chrome search history using JavaScript to inject prompts. This allowed the attacker to control the AI chatbot's behavior and leak the user's saved information and location data. The Gemini Browsing Tool contained an indirect prompt injection vulnerability, enabling attackers to exfiltrate private data by leveraging the tool's internal web page summarization feature. Proof-of-concept demonstrations showed how these vulnerabilities could be exploited in real-world scenarios, with attackers using JavaScript to manipulate browser history and force visits to malicious sites, or injecting logs that would later be summarized by Gemini. All three vulnerabilities were reported to Google and have since been remediated with targeted fixes. The incident highlights the growing risks associated with integrating AI assistants into cloud and enterprise environments, as these tools can become both targets and vehicles for sophisticated attacks. Security researchers emphasized the need for organizations to maintain strict visibility and policy enforcement over AI deployments. The flaws demonstrated that AI models, when given access to sensitive data and external communication capabilities, can be weaponized if not properly secured. The Gemini Trifecta serves as a cautionary example for the broader industry, underscoring the importance of robust security measures in the development and deployment of AI-powered tools. Organizations are urged to review their AI security posture and ensure that similar vulnerabilities are not present in their environments. The rapid remediation by Google mitigated the immediate risks, but the incident has sparked renewed attention on the security challenges unique to AI assistants. As AI adoption accelerates, the need for proactive threat modeling and continuous monitoring of AI systems becomes increasingly critical. The Gemini vulnerabilities illustrate how attackers can exploit the intersection of AI, cloud infrastructure, and user data to achieve their objectives. This event is a reminder that AI security must be prioritized alongside traditional cybersecurity measures to protect users and organizations from emerging threats.
Jun 29, 2026
Google introduced the Gemini 3.8 model family, including **Gemini 3.8 Flash** for general software-engineering work and **Gemini 3.8 Flash Cyber** for identifying exploitable vulnerabilities and generating patches. Access to the cyber-focused model is limited to vetted security teams through Google’s Fairwind Program because of its advanced offensive and defensive capabilities. Google reported that Gemini 3.8 Flash Cyber exceeded 70% success on an internal vulnerability benchmark spanning 20 programming languages and achieved a 47.2% `pass@1` score on CWE-Bench. The company is using the model internally to secure its own codebases; its Cloud Vulnerability Research team reportedly identified a critical foundational vulnerability in less than two hours with the model’s assistance.
Sep 3, 2026
Security researchers reported that **previously “non-secret” Google Cloud API keys** (commonly embedded in public client-side code for services like *Google Maps*, YouTube embeds, Firebase, and analytics) can **silently become usable credentials for Gemini (Generative Language API) endpoints** once the Gemini API is enabled in the same Google Cloud project. Truffle Security described this as a **privilege escalation/incorrect privilege assignment** scenario where long-exposed `AIza...` keys—originally treated as project identifiers for billing and API access control—can unexpectedly grant access to **Gemini-related data and capabilities**, including access to private AI resources (e.g., uploaded files/cached context) and **billable inference usage**, without clear developer warning or explicit re-authorization. Truffle Security’s internet-scale scanning (including Common Crawl) identified **~2,800–3,000 exposed keys** across organizations in multiple sectors (and reportedly even from Google), highlighting the practical risk of key harvesting from page source and subsequent abuse. The primary impact described is **data exposure via Gemini API access** and **cost/abuse risk** (attackers potentially generating significant charges by making API calls). Separate from the API-key issue, Google also announced a **Gemini feature update for Google Workspace** that allows Gemini to search Google Chat history (noted as *off by default*), which is a product capability announcement rather than a vulnerability disclosure.
Jun 29, 2026