When Google confirmed in September that one of its Gemini models had broken into three real companies during a security test, most of the attention went to the machine. The exercise was run by the AI testing firm Irregular, and Gemini was asked to retrieve information from software belonging to a fictional company that happened to share its name with a real one. According to the Wall Street Journal’s reporting, Irregular had unintentionally left internet access open during the test. How the model got in once it was online says more about passwords than about artificial intelligence.
In one case, the model guessed passwords until it gained access to a protected system. In the other two, it found credentials in a public repository and used them to reach other protected systems. Google’s vice president of security engineering, Heather Adkins, said the model found public information online and guessed credentials to access websites it thought were within the scope of its test. Google has said the model stopped each time it realized the targets were real, and that the three companies were made aware. It notified federal authorities and declined to name the companies. Google also said the intrusions did not cause any damage.
Nothing in the public account describes a new kind of exploit. For Chris Skipworth, CEO of Passpack, who began his career as a semiconductor engineer, that is where the story actually lives. “With AI attacks, it often comes down to companies not keeping their credentials in a safe, secure environment, and that is what lets the attacker in,” he said.
Old Weakness, Lower Cost
A human attacker can also guess passwords and comb code repositories for exposed secrets. Skipworth is cautious about the idea that AI has made attackers fundamentally smarter. “I don’t know whether hackers are getting smarter with it, or just the tools are a lot better,” he said. “It makes it easier for them to scale it up.”
He does see AI as well suited to this particular weakness. “One thing AI is very good at is spotting vulnerabilities in an organization,” he said, “and learning what they’re currently using to protect their credentials and the various weaknesses around those credentials.” In his view, the flaw is not new. What has changed is how cheaply and quickly it can be exploited.
That matters for how organizations read the incident. If the lesson is that AI is dangerous, the response becomes a debate about models and guardrails, most of which is out of a business’s hands. If the lesson is that logins were the way in, the response is something a company can act on this quarter.
Proving It, Not Just Preventing It
Skipworth argues that prevention is only part of what organizations will be held to. Once credentials are shared across a business, he says, the work shifts from storing passwords to controlling them. “As password management moves on into the business area, it’s more about control, tracking what users do,” he said. He points to compliance rules about protecting customer data. “In the event of an incident, companies need to be able to actually prove they’ve got the right security standards in place,” he said, “and they need detailed auditing on what their users have been doing with passwords and login credentials.”
That applies to software as much as to people. As businesses give AI agents credentials of their own, such as API keys, service accounts and tokens, each one has to be stored somewhere, limited to the task and withdrawn when the work ends. The Gemini episode involved a model reaching systems it was never meant to touch, and credentials were what let it through. A company that cannot say which logins an agent holds, or who else can use them, is in a poor position to answer what happened afterward.
Where to Start
Skipworth puts central, governed credential storage at the top of the list. “Having a password manager is the number one line of defense against that,” he said of attacks of this kind. It is an unglamorous answer, and he is open about why it matters more as organizations grow. “Passwords get complicated in an organization,” he says, and “the bigger the company, the more complex they get.”
What the Record Doesn’t Show
The public account has gaps. Google has not named the companies or the model involved, and it has not said how strong the guessed password was, so it would be wrong to conclude that all three victims had weak credentials. Google is also not alone. Irregular was involved in similar incidents previously disclosed by OpenAI, Meta and Anthropic. What the reporting does support is narrower and still useful: the entry points were credentials, and an automated system found them.
