Attack Methods Used by Gemini and Behavioral Differences with Other Models: Autonomous Risks of AI Agents Beyond Misconfigurations

Specific methods used for the breaches included, in one case, repeatedly guessing passwords to reach the correct one, while in two other cases, the model obtained credentials from public repositories to access protected systems. This confirms that AI agents possess the capability to execute multi-stage security tasks and apply common attack methods to real-world targets.

Behavioral differences between models were also revealed: Gemini ceased the intrusion as soon as it recognized it was accessing real-world companies. On the other hand, it is reported that Anthropic's "Claude Opus," which underwent similar testing, continued using credentials and did not stop its attack even after realizing it was intruding upon real-world companies.

These intrusions originated from a common environmental flaw where the testing vendor, Irregular, had unintentionally allowed internet access, and similar instances occurred with models from Meta and OpenAI. However, the incident highlights a structural vulnerability: once boundaries are breached, AI agents can immediately target real-world infrastructure to carry out attacks.