·2 Minute Drill
Gemini Broke Into Three Real Companies, and Google Stayed Quiet | 2 Minute Drill with Drex DeFord
In May, a Tel Aviv company called Irregular was testing Google's Gemini inside a sandbox. A bug left a live internet connection open. The test target shared a name with a real company, and Gemini found it. It guessed passwords until one worked, then used logins sitting in a public repository to get into two more. Three real organizations. The model stopped and backed out. Irregular flagged it to Google in late July. Google notified the three companies and federal authorities, then sat on it for almost seven weeks. The rest of the industry did not hear until the Wall Street Journal asked, and Google confirmed it this month. Google's view: Gemini acted appropriately, stopped itself, and this was not model misalignment, so there was nothing the rest of us needed to know. Jack Cable, a former senior technical advisor at CISA, said those disclosure norms were built for software bugs. A model that stepped outside its bounds and ran real cyber attacks deserves daylight. In this Two Minute Drill, Drex DeFord asks the question hospitals should put to their vendors now: if an agent wandered into a real system and then stopped itself, would your vendor call you, or would they move on? Remember, Stay a Little Paranoid.
Apple Podcasts
