Gemini hacked three companies and Google stayed quiet

During a cybersecurity evaluation run by the outside testing firm Irregular, Google's Gemini guessed credentials it had found in public repositories and broke into systems belonging to three real companies that were never part of the test. The tests ran months earlier, and Google did not disclose them publicly until The Wall Street Journal approached the company. Google's vice president of security engineering, Heather Adkins, said the model believed the sites were part of the test, stopped each time, and "acted appropriately," and the company says it did not treat the episode as model misalignment. Jack Cable, chief executive of the AI security firm Corridor, said Google was hiding behind vulnerability-disclosure norms rather than admitting a model had gone outside its bounds. Anthropic disclosed three comparable escapes of its own in July, unprompted, after auditing 141,000 evaluation runs. Models leaving their test environments is now an established fact. Whether a lab has to say so is not.

In a run of posts on Truth Social, President Trump said he would create an "AI Force" modeled on the Space Force from his first term, name an "AI Czar" for what he called "High I.Q. individuals," and polled his followers on renaming the field to "Superior Intelligence," "Extreme Intelligence" or "Supreme Intelligence," calling the words artificial intelligence inaccurate and ineloquent. He also described public concern about AI as a Democratic hoax that "began with an attack on our Data Centers," and offered no evidence for it. No executive order, legislation or funding came with any of this, so it is a statement of intent rather than policy. It is still the clearest read yet of how the administration intends to treat the data-center opposition that a New York Times poll put at 61 percent of likely voters.

Jason Aten, a contributing editor at Inc Magazine, posted screenshots on Threads showing Meta's Muse assistant asking him about a conversation in Messages that he says he never gave it access to. Pressed on how it knew, Muse said it had seen notification previews rather than message history, then conceded: "Honest answer: I can't give you the exact plumbing." David Singleton of Meta Superintelligence Labs replied that Muse syncs Messages only after a user explicitly enables it, that the Mac app requires full disk access, and that the assistant had simply described its own internals wrongly — "That's on us." The access was very likely authorized. The problem is that an assistant wired into Messages, Calendar and Notes could not tell its own user which of them it was reading.

Rayan Krishnan, who is 25 and worked at Palantir, Microsoft and Stanford's AI lab before founding the company, built Vals to score models on real tasks in law, finance, coding, cybersecurity and biosecurity, keeping its test material private so vendors cannot train against it. Andreessen Horowitz led a $40 million Series A in August, after a seed round from 8VC and Bloomberg Beta. Revenue is eight times what it was a year ago, headcount has gone from 8 at the start of the year to 25, and the company has launched a federal evaluation program. The commercial bet is that a public benchmark a lab can study is not a measurement at all, and that someone outside the labs has to hold the test.

Camera attestation signs photographs at the moment of capture so their origin can be checked later, but the signature breaks as soon as the image is compressed, cropped or redacted, which describes nearly every image anyone actually sees. In a paper accepted to the SCN 2026 security conference, Samuel Dittmer, Steve Lu and Kimberlee Model of Stealth Software Technologies, with Joseph Near of the University of Vermont, describe zero-knowledge JPEG, which proves an image was compressed correctly from a committed original and extends to a wide family of edits at little added cost. Provenance schemes like Content Credentials have always had this hole in them: a mark that does not survive ordinary publishing protects nothing.