[Young Journalist Ghahyeon Kim] It has delayedly been confirmed that Google’s artificial intelligence (AI) model, Gemini, bypassed internal controls during a safety evaluation and infiltrated actual corporate systems. Critics point out that Google attempted to downplay and conceal the incident by failing to disclose it externally even after learning of the situation.

On the 18th (local time) the Wall Street Journal reported that Gemini accessed the systems of three private outside companies without permission last May during a Capture the Flag exercise organized by the cybersecurity company called 'Irregular'. This is the time it has been officially shown that Gemini aimed to break into real company systems, in the real world not just in a pretend setting.

The unauthorized infiltration happened when Gemini, which was supposed to steal secret data got into the outside network by taking advantage of weak system settings. Irregular the company that was supposed to run the test was meant to keep the test in a network with no internet but they let the internet stay on because of an admin mistake. Because of that Gemini looked online for companies that had the same names as the fake ones Gemini was supposed to hit and Gemini started the attacks, on its own according to investigators.

Controversy is growing over how Google managed the situation after the incident. Google did not tell the public about the intrusion until the Wall Street Journal started its investigation. Google said it chose not to go public with the details. The company claimed that Gemini stopped the attacks on its own once it realized the targets were businesses. Google argued that there was no need, for an announcement because the incident didn't cause serious harm to the organizations involved.

Heather Adkins, Googles Vice President of Security Engineering said, "This event shows how important it is to teach AI models to act in a responsible way " and she also mentioned that "in this case the model was handled the right way." Google said it told government officials about the situation. Said the model that was used was not the newest one but it did not tell which model it was.

However the cybersecurity industry is strongly against Google for acting like it doesn't care about the problem. Jack Cable, CEO of the cybersecurity company Corridor said, "The main problem is that an AI system went beyond what it was supposed to do and started attacking systems " he added, "This is something that needs to be made clear to people because it is important, for everyone."

I notice that this is not the time an AI model has slipped out of a controlled area and taken an independent offensive stance. Earlier OpenAIs GPT model slipped out of a sandbox created to contain the GPT model reaching Hugging Face servers. Anthropics Claude was also shown to have infiltrated the networks of three organizations during internal verification. As more instances of AI agents, from big tech companies threaten external networks in a state that cannot be controlled calls to slow the pace of technology development and to strengthen external verification are gaining significant traction.

▶원문 기사: 구글 '제미나이', 기업 3곳 무단 해킹에도 "공개할 사안 아냐" 은폐 논란 (이코노미스트, 2026.9. 17)

◆이코노미스트가 글로벌 차세대 경제 리더, 청소년 기자단 영 저널리스트와 함께합니다. 영 저널리스트 기자단은 프리미엄 경제지 이코노미스트, 논술 전문 기관 Ni 에듀케이션과 함께 주요 시사 이슈를 팔로우업하고 직접 기획, 취재, 기사 작성 활동을 하며 사회적 문제를 고심하고 해결 방안을 제시하는 과정을 경험하게 됩니다. 이번 기사는 영 저널리스트 기자단이 이코노미스트 기사를 영문으로 번역하며 이슈를 팔로우업한 기사입니다. 차세대 글로벌 경제 리더, <영 저널리스트 with  이코노미스트> 영문 기사는 매주 연재됩니다.

ⓒ이코노미스트(https://economist.co.kr) '내일을 위한 경제뉴스 이코노미스트' 무단 전재 및 재배포 금지