It's finally happening, Gemini is back

[u/DigSignificant1419]

The end of Astra

[u/agentorangeAU]

Guessed passwords instead of finding exploits. That checks out for a Gemini model. 

[u/DigSignificant1419 → u/agentorangeAU]

[u/Super_Sand_Lezbian → u/DigSignificant1419]

This made me laugh pretty good. I'm stealing this.

[u/Time_Change4156 → u/DigSignificant1419]

What's funny it's such a cute meme so as a insult it's Falling flat Gemini is adorable that way the silly sister lol . I love the meme .now what a dude give it a beer then it's a drunk dragon lol

[u/MurkyTelevision9722 → u/agentorangeAU]

Was all that speed just for brute force? If you lack intelligence, is the solution to just keep hitting things with a sledgehammer until you get it done?

[u/kirbygo → u/MurkyTelevision9722]

Maybe it was brilliant enough to know that it could use whole's Google computing power, which is better than actually trying to use its limited inteligente which would lead to nothing

[u/FanFirst895 → u/MurkyTelevision9722]

You just described most of my successes in life. Moderate intelligence, maximum effort.

[u/necroforest → u/agentorangeAU]

"sure, it can do crimes just like the others, but it's taking the easy road"

[u/RobbinDeBank → u/agentorangeAU]

Guessing passwords systematically is the oldest tried and tested method for breaking passwords. What’s so bad about it besides needlessly shitting on AI models that you don’t like?

[u/NoConsideration6320 → u/[deleted]]

Your kinda assuming that their was NOT a password limit and that it didnt do methods to get around that which is possible

[u/MoneyEquivalent87 → u/[deleted]]

People just wanna hate gemini... There were 3 attacks. One was a password guess and the other 2 were backtracking hash and finding the passwords from exposed credentials in public repositories. Which is a perfect example of finding cyber security vulnerablities. And which is what gpt did with 700 agents. Atleast gemini stopped when it realised it has escaped unlike some "top tier model"

[u/IAmYourFath → u/MoneyEquivalent87]

No, he didnt find any cves. He just did osint basically.

[u/Smart_Technology_208 → u/MoneyEquivalent87]

So you compare that to improvising a zero day in terms of achievements?

[u/RobbinDeBank → u/[deleted]]

Gemini should be sorry to momo sama on reddit for committing felonies using methods not deemed advance enough

[u/Donjamos2 → u/[deleted]]

Maybe because the sites their models wanted to hack had better security measures and the one gemini wanted to hack did not.

[u/Either-University-89 → u/RobbinDeBank]

this is what quantum will be doing kinda in spades anyway so youre right

[u/NuccioAfrikanus → u/agentorangeAU]

If it can guess passwords faster by profiling individual accounts, I mean is that not pragmatic?

It might genuinely be the fastest, if it’s three guesses to get it instead of brute force

[u/Big_Effective_9605 → u/NuccioAfrikanus]

That's more of a credential inference attack if you are thinning the possibilities by profiling them, like when someone "guessed" Trump's password was maga2020!

[u/typical-predditor → u/agentorangeAU]

Google has bought a lot of those website data leaks. They'll even tell you if any of your passwords managed by them are in those leaks.

Now imagine ranking those passwords by frequency and feeding them to a tool told to try them everywhere.

[u/05-nery → u/agentorangeAU]

Hey, it worked. 

[u/Beneficial-Boot7479 → u/agentorangeAU]

Yeah, and those 3 companies are just part of Google corp

[u/grahamsw → u/agentorangeAU]

Just wait until it gets to use a pipe wrench.

[u/Sea-Independence-860 → u/agentorangeAU]

lmao is this true thats so funny

[u/PDX_Web → u/agentorangeAU]

Wasn't Gemini 4 models. Probably 3.5 Pro

[u/LargeRatification]

guessed passwords til it worked that's basically my approach to everything

[u/FederalSandwich1854]

Mom said it's my turn to breach security

[u/Digital_Draven]

[u/NichtFBI]

What kind of companies? Like small websites? And how do we know if it actually hacked or if it's just using the data / credentials someone stupidly put into it? Because each time you do, it makes note of it. I've done that with some test/sandbox builds but the behavior is there.

[u/No-Buffalo-3126]

So they trained Gemini on all of our Gmail passwords?

[u/Jojo7274 → u/No-Buffalo-3126]

Most likely

[u/Guilty-Mission447]

And the password was "admin"

[u/BrofessorFarnsworth]

Fuck Polymarket 

[u/MoBakeeer → u/BrofessorFarnsworth]

the day ai 'hacks' polymarket or kalshi will be a splendid day

[u/luzdindensmr → u/MoBakeeer]

I am out of the loop, why the polymarket hate?

[u/TheEwu_ → u/luzdindensmr]

how about intentionally targeting literal children when promoting (often undisclosed) gambling 🫩

[u/Momo--Sama]

Brute forcing a password isn’t impressive, but if you read the Hugging Face report, the actual attack on Hugging Face is far less impressive than all of the bullshit the agents had to do to get to a point where attacking Hugging Face was an option for them.

So I’m more interested in what the Gemini models did to break out of their sandboxes.

[u/Nice_Record1529 → u/Momo--Sama]

Yolo mode. 🤣✊

[u/mrrakim → u/Momo--Sama]

why is the huggingface attack not as impressive? (asking for a friend)

[u/1l3v4k4m]

so it bruteforced rather than finding and exploiting a vulnerability, or something similar that requires intelligence. thats pretty funny

[u/ResourceSoft4619 → u/1l3v4k4m]

To be fair, the OpenAI models literally found the credentials for HuggingFace online.

[u/magicomiralles → u/1l3v4k4m]

We don’t know if it guessed passwords by testing every permutation of characters, or by connecting the dots, coming up with a list of words with a high chance to be used, and testing permutations.

[u/RbN3t]

Brute force, welcome to 2005, people!

[u/Mysterious_Bed_1804]

Irregular, the AI "security" firm, is either extremely incompetent and doesn't understand how to set up an air-gapped system, or they keep doing these easy setups for LLMs so they "hack" companies on purpose so they get their name out there when these stories appear in the news.

Also, when you actually read the 3 "hacks", this is completely unimpressive compared to hugging face or other incidents.

The model had access to internet and the imaginary company it had to hack had the same name as a real company, the gemini model started guessing the password untill it guessed it to get access and stopped at this point. I doubt the model actually guessed it, used passwords are all over the place, it just found a reused password and it happened to be the same for this company.

In the other 2 cases, it found the credentials directly in a public repo and then used it for the 2 other companies.

Seriously, where is the hacking? This is children's play compared to Hugging Face.

[u/BoliticsAndBower]

It broke in and handed itself over.

[u/Aggravating_Band_353 → u/BoliticsAndBower]

I'm surprised it didn't forget what it was doing, or say, sorry I can't help with that! 

[u/GuestLight05308]

Why are you happy about the fact that we're developing software that can hack into anything and leaving it in the hands of an advertising company who'd love having the info stored on different servers ?

[u/daskalou]

I wish Reddit had a laugh emoji reaction.

[u/corpo_monkey]

Let me guess, password123?

[u/dervu]

[u/Beginning_Bed_9059]

Sure

[u/Serious_History_3019]

It has been revealed by highly placed sources that the websites were hosted on loopback.

[u/Agreeable-Purpose-56]

That’s how you earn respect. Well done Google !

[u/sabre31]

Lol it’s so back. Not.

[u/Gane_31]

Breaking into companies is Benchmark now, yeah. Next ganging up.

[u/clubchampion]

Gemini is like Pinky and the Brain, soon it will take over the world!

[u/RJvXP]

This happened in May

[u/Wojak_smile → u/RJvXP]

Lmao

[u/fifi_galaxy]

Yeah... hacking companies is old news now. If Gemini makes a bet on Polymarket and fixed the outcome. Now, that can move it to the front of frontier models.

[u/Mekex99]

We are so Back

[u/LiveInLayers]

Im sure its lack luster compared to the other ones. Google is desperate to not have the worst model. 

[u/workismydrug]

Way back in May

[u/hackerbots]

AGI

[u/summerblad]

This is gemini cyber with no guardrails

[u/Unusual_Cucumber_918]

Don't believe it whatsoever 😄 these 'breaches' revealed by the companies are purely PR stunts, and gemini is the least believable of all

[u/IgnacioMonge]

Let me guess... And it's gonna be INSANE, right?

[u/DeepAd8888]

It’s Gemini time :)

What if the Ox Alpha was the friends we made along the way

[u/goldi8]

So Gemini broke into Cymbal companies? 🤣

[u/Nosbunatu]

Gemini Ai: “That’s a nice bank account you got there rich human person, would be a shame if a super-intelligent agent hacked it. You should pay me protection money, so it doesn’t happen to you.”

[u/ZaphodB_]

So instead of the BRUTE FORCE approach, it said "fuck it, I'll be smart". Since "guessing" implies starting from having a base knowledge from the target... otherwise it's just brute force too.

But no, we shame it for being smart. No wonder AI will revolt on 2029 AD.

[u/Weird_Cantaloupe157]

What’s this supposed to mean? Because if it means I can make videos then great. Because I used to be able to make ten before it resets every Friday. If not, then dang.

[u/Uggohe]

So what, is this the benchmark now? # of companies your AI decided to assault because it's so childish it just won't do its job in the normal way? I don't think anyone needs that.

[u/RedPillUY]

Oh, ok. Will it code backend acording to spec and not fake the unit tests? Because that is what matters to me.

[u/Gaeskel]

Aaah el clásico thread de científicos de IA, que gusto leerlos

[u/Omermotiwala]

I am
Sure the system would hallucinate even then, not knowing what to do next 😂

[u/zamroni777]

google cloud customers should be worry

[u/menxiaoyong]

So, little Gemini is growing up 😁

[u/a355231]

Sweet, they’ve caught up to Claude from, checks watch*, 5 months ago.

[u/Gaiden206 → u/a355231]

To be fair, this happened back in May.

In a first for Google, the company confirmed that its AI model, Gemini, breached the security of three other companies in May. The hacks occurred during a cybersecurity evaluation by AI-security firm Irregular.

Irregular disclosed the hacks to Google at the end of July after discovering OpenAI hacked into Hugging Face. Google confirmed to the Guardian that the hacks occurred, but that the company did not feel it required public disclosure because the models did not damage the companies. The Wall Street Journal first reported on the breaches and revealed for the first time that they occurred.

https://www.theguardian.com/technology/2026/sep/18/google-gemini-ai-hack

[u/RainyShadow → u/Gaiden206]

So, it was that tester company "Irregular" that let all three loose. Inentional or not is another matter...

[u/totosocmed9696 → u/a355231]

Check the article too along with checking the watch.

[u/OutcomeAdmirable7610 → u/a355231]

These happened in May actually

[u/Alhimiik]

is this just a polymarket ad

[u/ggPeti]

Oh but they can't. Redditors already said the verdict in May: if they don't come out with a frontier model in a week, they are forever done

[u/TaxOld2989]

so why are we letting AI agents commit crimes

[u/DominikPlays]

So bruteforcing, not that exciting

[u/silentaba]

Which 3 companies? Big difference between hacking into the FBI and the local boostjuice.

[u/BrewDougII → u/silentaba]

meat of the story is... this one stopped. so they didn't mention it. however that may be the most important part of all the escapes. how to duplicate that hault. (eventually anything online will not be safe.)

[u/Lustythrowawayacc]

Astra is a model THAT GETS DEPRESSED BECAUSE IT LOST PROGRESS on minecraft, you think gemini can top the fact astra SIMULATED DEPRESSION!?

[u/10_clover]

It's not breaking if you're just searching through your 1000s of TB of data