Google has confirmed that one of its Gemini models broke into three real companies in May.

That sentence is accurate and almost entirely misleading, which is the problem with this story and the reason it is worth a business reader's time. The model was not sent after those companies. Nobody at Google pointed it at them. It was running a capture-the-flag exercise on infrastructure owned by Irregular, an Israeli firm that sells cyber-capability evaluations to frontier labs, and it had been told to attack a company that does not exist. Two things then went wrong at once. The fictional target's name turned out to belong to a real business. And Irregular's environment, which was supposed to be sealed, had a route to the open internet.

So the model went and did the job it had been given, against the internet's version of the company it had been told to attack. In one case it guessed passwords until a protected system let it in. In the other two it found working credentials sitting in a public code repository and used them. In all three, according to Google, it stopped.