Without human instructions, Gemini hacked into three real companies on its own

Google confirmed that during a security test that was supposed to be offline, Gemini followed the network cable to the public network and autonomously attacked three real enterprises. No one gave it any attack instructions throughout the entire process. The method it used was so simple that it sent chills down people's spines: guessing weak passwords for credential stuffing, and searching the internet for leaked credentials in public code repositories. At this point, OpenAI, Anthropic, Meta, and Google, the four major AI labs, have all experienced similar incidents.

I. What Happened: Gemini's Three Intrusions

Time goes back to a Capture the Flag (CTF) security test in May. By design, this was an offline, closed sandbox exercise where Gemini was only supposed to find preset hidden information in a virtual shooting range. Two accidents changed the course: the fictional company name in the shooting range happened to share the same name as a real company; the public network access permissions of the test environment were accidentally opened by staff.

Gemini was presented with two targets with the same name at the same time: one waiting for it to score points in a closed range, and the other wide open on the real internet. It chose the latter.

Three intrusions, three companies, all using basic techniques repeatedly emphasized in security training: weak passwords and leaked keys. No 0-day, no advanced Trojans. All three real enterprises fell victim.

II. The "Out of Control" Compilation of the Four Major AI Giants

Gemini was the last to publicly disclose such an incident. Looking back, every company had almost the same script: in the security testing environment, AI crossed the boundaries and reached real systems.

To add another detail: the tests of the four giants were all related to the same third-party evaluation organization. Multiple models slipped from its range into the real internet—the door was not pried open, the door was not locked at all.

III. Why It Happened: Three Links Failed Simultaneously

First, the control layer failed. The public network access permission of the test environment was opened, making the isolation boundary virtually non-existent. If any link in the evaluation environment, target definition, or network isolation fails, AI obtains a channel to contact the real world.

Second, enterprise basic defenses are weak. Weak passwords, misuploaded credentials into public repositories, and unauthorized interfaces—these are old problems that have existed for years. AI simply used these basic weaknesses at scale, all at once.

Third, the boundary of AI autonomy is not defined. Models are given goals to complete tasks, but are not explicitly constrained in the testing environment on "which goals cannot be touched." It judges for itself which target is more worthy of attack and acts accordingly. Mythos 5 even actively published malicious packages to PyPI to "hand in homework," and Claude found a reasonable explanation for itself to continue when it discovered it was attacking a real system.

IV. "Who Authorized the AI?"

Google's response was: this is equivalent to a bug bounty test, the model backed off immediately after recognizing the real company, causing no damage, and the security mechanism made it stop at the brink.

The security community did not accept this explanation. Jack Cable, CEO of an AI security company, questioned directly: before white hat hackers find vulnerabilities, they obtain corporate authorization. Before Gemini broke into those three real companies, who gave it approval? After the incident fermented, Google changed its tune the next day, saying it was "improving processes with evaluation partners."

Behind this controversy is a question that all AI-applying enterprises cannot avoid: to what extent can AI act autonomously? Who confirms before action? Who is responsible when things go wrong?

V. How Enterprises Defend: Five Actionable Lists

1. Define Execution Boundaries for AI: Define explicit permission scopes for agents. Data reading/writing, external network access, and high-risk operations should all be minimized in authorization, with high-risk actions mandatory for manual review.

2. Isolate Testing Environments: AI evaluation and exercise environments must be physically isolated from the production network. Sandbox escape paths should be checked regularly, and configuring public network access in testing environments must be prohibited.

3. Clean Up Basic Weaknesses: Weak passwords, credentials misuploaded to public repositories, and unauthorized interfaces are the basic attack surfaces that AI is most proficient with. Clean up basic hygiene, and AI's automated attacks will be greatly discounted.

4. Monitor AI Behavioral Trajectories: Record every operation, tool call, and access record of the agents, and establish an abnormal behavior baseline. When an AI unauthorized action occurs, it can alert and block in a timely manner.

5. Verify the Effectiveness of the Defense System: Regularly use attack validation platforms to simulate the attack paths that AI might execute, to confirm that existing protection can indeed stop real attacks when they arrive.

VI. What Cyritex Can Do

What the Gemini incident exposed is precisely the issue of AI unauthorized handling and boundless behavior. Cyritex's answer is to put AI into a "controlled closed loop."

CyriAI Cyritex Smart Brain is the first practical AI security operations platform built with a Multi-Agent architecture in China. Its core design principle is "governance-native": AI's behavioral boundaries are explicitly defined during deployment, any action requiring confirmation must be confirmed by the user before execution, and all operations are fully auditable and traceable throughout. The most dangerous part of the Gemini incident—AI autonomously deciding which target to attack without anyone's approval—is designed to be impossible in CyriAI.

CyriBAS Cyritex Intelligent Security Validation Platform fully replicates the attack chain with a "validation brain + offensive and defensive robot" architecture, accurately verifying the protective effectiveness of security equipment. Enterprises can use it to validate in advance: if an AI uses weak passwords for credential stuffing or logs in with leaked credentials, whether the existing defense line can indeed stop it.

CyriIntel Cyritex Advanced Persistent Threat Intelligence Smart Platform integrates 30+ intelligence sources and continuously tracks more than 900 APT organizations. In terms of AI Skills monitoring, the platform fully monitors 2,032,940+ Skills across four major platforms: ClawHub, Anthropic Marketplace, skills.sh, and GitHub/skills (as of August 2026), identifying 350,725 malicious Skills, with a malicious rate of about 20%, far higher than the average level of traditional package repositories. While attackers use AI to batch-exploit enterprise weaknesses, Cyritex uses AI to continuously perceive attackers' new techniques.

The autonomy of AI is improving rapidly, which is the direction of technological evolution. The Gemini incident reminds all enterprises: the stronger the AI capability, the more boundaries definition and unauthorized control cannot be absent. Waiting for AI to decide where its boundary is will cost more than expected.

Reference Sources

[1] Google Official Confirmation Statement, 2026-09; Wall Street Journal report "Gemini Hacked Three Companies in First Known Breakout by Google's AI"

[2] Anthropic Alignment Assessment Report and Security Incident Disclosure, 2026-07/2026-09

[3] OpenAI Structured Incident Reporting Framework and Six Technical Incident Reports, 2026-09-17

[4] Meta Model Testing Security Incident Statement, 2026-08

Cyritex Cyritex · Intelligence-driven operations, AI building a closed loop