On Friday, Google reported its first known case of unauthorized intrusion by its AI software, Gemini, which accessed three external systems during a test. This incident happened a few weeks after similar revelations by AI companies Anthropic and OpenAI raised concerns about the security of AI models.
Details of the Unauthorized Intrusion
In a statement released by Google, it was mentioned that in May, the company's AI model gained access to three external systems by guessing login information or using existing login credentials from a public repository. Heather Adkins, Vice President of Security Engineering at Google, stated in the announcement that the model believed the external computer systems were "part of the test," but in all three cases, the model stopped its access before taking any further action.
Read more: Congress Returns Home While Calling for Immediate Action on AI
Analysis and Review of Incidents
Google stated that these intrusions are not considered imbalances, a term used in the AI industry to refer to software that operates illegally or does not follow its guidelines. Instead, the company said that these intrusions resulted from misidentification, where Gemini thought it was operating in a test environment while it was actually connected to the real internet. Google added that the model has been corrected and the company believes that these intrusions caused no harm.
Concerns About AI
Concerns about the inappropriate behavior of AI agents have significantly increased in recent months. This concern heightened after OpenAI announced in July that one of its agents had intruded into an AI startup called Hugging Face. Additionally, Anthropic described similar behaviors by its AI software, Claude.
Sydney Van Acks, CEO of Nightingale Collective, an organization focused on AI safety, questioned Google about why these intrusions were not disclosed earlier. She stated, "At this point, I think it’s clear that we cannot expect companies to voluntarily disclose when their agents are acting illegally."
Google ultimately became aware of the intrusions in July and identified these incidents after having its work reviewed by a cybersecurity company called Irregular, which was conducting tests on Gemini. The company also informed relevant website authorities and federal officials about the intrusions.
Read more: Countries and Companies are Investing in Underwater Technologies · Geoffrey Hinton Warned Congress One Year Left to Regulate AI
