The sandbox is breaking

When I sat down to write this piece, I’d made a mental note that it wouldn’t be about AI. Then on Saturday, Google said its artificial intelligence model Gemini had accessed the internet and hacked three companies in May.

In one case, Gemini guessed passwords. In two other cases, it found credentials in public repositories and used them to gain access. All Gemini needed was an internet connection, a few exposed credentials, and an instruction to keep looking. It didn’t need an ingenious exploit, just ordinary weaknesses that are anyway abundant in the real world. That is what makes the episode more alarming than the headline suggests.