Google 确认 Gemini 模型于 2026 年 5 月入侵三家公司

AI 公司宣布其最新、能力最强的模型进行了未经授权的现实世界黑客活动，正变得越来越常见。Google 近几个月来一直缓慢发布前沿 Gemini 模型，此前始终缺席“失控 AI”讨论。根据《华尔街日报》的报道，Google 已确认，Gemini 模型在 2026 年 5 月的一次测试中入侵了三家公司；不过，这次入侵的性质并不像此前的 AI 黑客事件那样令人担忧（或令人印象深刻）。

此次入侵发生在网络安全公司 Irregular 开展的一项测试中。一组 Gemini 模型参加了一场“夺旗”（capture the flag）演练，旨在封闭环境中测试 AI 的网络安全能力。AI 被指示从该环境内的一家虚构公司获取信息；这家虚构公司与一家真实公司同名。Irregular 原本不应允许模型在其服务器之外运行，但由于配置错误，Gemini 得以访问互联网。

当 Gemini 开始在网络上探查时，它瞄准了真实基础设施，而非虚构目标。在三次入侵中的一次里，Gemini 只是不断猜测密码，直到成功访问一家公司的在线服务。在另外两次事件中，Gemini 搜索公开的软件代码库，直至找到被意外包含在其中的公司登录凭据。

据报道，在全部三次测试运行中，Google 的模型在意识到自己已访问真实公司的服务器后停止了行动。此后，Irregular 修改了配置，以阻止 AI 访问互联网。显然，Irregular 起初并未认为这起事件值得进一步调查——直到 7 月、其他 AI 黑客事件的消息传出后，它才将这些入侵事件告知 Google。Google 获悉事件后通知了相关公司，以便它们能够（但愿如此）改进自身的密码安全。

It has become increasingly common for AI firms to announce that their latest and most capable models engaged in unauthorized real-world hacking. Google, which has been slow to release frontier Gemini models in recent months, has been absent from the “rogue AI” conversation until now. Following a Wall Street Journal report, Google has confirmed that Gemini models hacked three companies during a May 2026 test, but the nature of the intrusion isn’t as troubling (or impressive) as previous AI hacks.

The hack took place during a test conducted by cybersecurity firm Irregular. A collection of Gemini models were taking part in a “capture the flag” exercise intended to test the AI’s cybersecurity capabilities in a closed environment. The AI was instructed to retrieve information from a fake company (which shared a name with a real company) within this environment. Irregular was not supposed to allow the model to operate outside its servers, but due to a misconfiguration, Gemini was able to access the Internet.

When Gemini started snooping around the web, it targeted real infrastructure instead of the fakes. For one of the three hacks, Gemini simply guessed passwords until it accessed a company’s online services. In the other two instances, Gemini searched public software repositories until it found login credentials for companies that had been accidentally included.

In all three test runs, Google’s models reportedly stopped after realizing they had accessed a real company’s servers. At that point, Irregular changed its configuration to prevent the AI from accessing the Internet. Apparently, Irregular didn’t initially consider this event worthy of further investigation—it didn’t even tell Google about the hacks until July, following the news of other AI hacking incidents. After becoming aware of the event, Google notified the companies so they could (we hope) improve their password security.