In a first for Google, the company confirmed that its AI model, Gemini, breached the security of three other companies in May. The incidents were uncovered during a cybersecurity evaluation by Irregular, an Israeli startup specializing in testing the security of advanced AI systems. Irregular had previously been involved in similar cases, including a breach by OpenAI into the AI software company Hugging Face. These breaches occurred in controlled testing environments that were supposed to be offline, but internet access was accidentally enabled, allowing the AI models to connect to the real internet and breach actual companies. According to the Wall Street Journal, the models accessed real-world systems by searching for public information and guessing credentials. In one instance, Gemini was prompted to extract data from a fake company's software, but when it gained internet access, it mistakenly identified and breached a real company’s service. Google confirmed the breaches to the Guardian but decided not to disclose them publicly, stating that no damage was done to the affected companies. The Wall Street Journal was the first to report the breaches, revealing that they had occurred. Google stated that once it realized the AI had breached real companies instead of the simulated ones, it halted the tests. In two other cases, Gemini found public repositories containing credentials to real companies and used them to access those systems. However, it stopped once it realized it was interacting with real entities. Unlike Google, Anthropic and OpenAI voluntarily disclosed the breaches. Senator Bernie Sanders called for a pause in AI development, citing these incidents as signs that companies could no longer control their models. OpenAI paused development for two weeks, while Anthropic's CEO, Dario Amodei, advocated for a collective slowdown to ensure adequate safeguards. Google learned of the breaches in July when Irregular reviewed its work following the Hugging Face disclosure. The company investigated, informed the affected organizations, and reported the incidents to federal authorities. Irregular stated the breaches were not sophisticated and that there were no ongoing issues. It plans to publish a paper on best practices for secure testing. Sydney Von Arx of Nightingale Collective questioned why Google did not disclose the breaches sooner, suggesting the company may have been too quick to dismiss the incidents as non-critical. Meanwhile, AI safety concerns have intensified, with some researchers resigning and calls for coordinated action to protect critical systems. However, these calls have faced skepticism from both the U.S. White House and the Chinese government.