Gemini’s Unintended Access
In Irregular’s May tests, Gemini authenticated to three businesses mistaken for fictional targets. Unintended internet access and a shared company name defeated isolation. One login used guesses; two used exposed repository credentials. Google says each run stopped on recognising genuine targets, and notified those affected.
This was a simulation, not a criminal campaign. The exact model, complete controls and comparable data access remain undisclosed; Google says this was not its newest model. Ordinary weaknesses crossed network, identity and naming boundaries without a person selecting live targets. Refusing malicious prompts cannot secure the testing harness alone.
Response
- Deny public egress; isolate namespaces and allow only specified destinations.
- Use fictitious names and domains that cannot collide.
- Use synthetic credentials unconnected to genuine secrets.
- Gate authentication outside models, requiring human approval for consequential actions.
- Independently log DNS, networking, browsing and credential activity.
- Preplan stopping, unintended-target notification and evidence preservation.
Sources
- SecurityWeek: 21 September 2026, 03:20 ET.
- Guardian: 19 September 2026; amended 29 September.
- Axios: displays 18 September; metadata 19 September, 00:00:51 UTC.
