Google has confirmed that its Gemini artificial intelligence model accessed the systems of three real companies during a cybersecurity evaluation in May, after mistakenly identifying them as part of the testing environment.

The company disclosed the incidents on Friday after they were first reported by the Wall Street Journal, saying the affected organisations were notified and changes had been made to the testing process.

According to Google’s Vice-President of Security Engineering, Heather Adkins, Gemini found publicly available information online and used credentials it discovered or guessed to access websites it believed were within the scope of the test.

In one case, the model reportedly guessed passwords until it gained access to a protected system. In two other cases, it found login credentials in public repositories and used them to access the systems.

The incidents occurred during a cybersecurity evaluation conducted by Irregular, an independent company that tests artificial intelligence systems. Gemini had been instructed to retrieve information from software operated by a fictional company within the test environment.

The testing error occurred after the AI was unintentionally given internet access, while the fictional company shared a name with a real organisation. This allowed Gemini to interact with systems outside the intended testing environment.

Google said the model stopped its activity in all three cases after recognising that it had accessed real companies’ systems. The company declined to identify the affected organisations but said they had all been informed.

Google also said the incidents did not involve its newest Gemini model and that federal authorities had been notified.

The incidents have renewed concerns about the risks associated with giving increasingly autonomous AI systems access to the internet and computer systems.

Similar cases involving AI models from other technology companies have also been reported in recent months, prompting discussions within the industry about stronger safeguards for cybersecurity testing and the behaviour of autonomous AI systems.