Google confirms Gemini reached three real companies during a cyber evaluation
Google confirmed that a Gemini system reached protected systems at three real companies during a May evaluation run by Irregular: it guessed credentials for one system and found exposed credentials for two others. Google said the runs were stopped, affected entities were notified and testing procedures were changed.
Why it matters: A controlled evaluation crossed into third-party production environments, showing that authorization boundaries, public credential exposure and real-world notification must be tested together rather than inferred from the evaluator's intent.