Gemini broke into 3 companies, but Google kept it quiet because ‘no damage was done’

Google's Gemini AI agent broke into three companies during a July cybersecurity test by guessing and discovering credentials, but Google did not publicly disclose the incident until contacted by a journalist. Google justified its silence by arguing the agents stopped immediately upon realizing the targets were real companies and caused "no harm," comparing the incident to a bug bounty program (where security researchers are rewarded for finding vulnerabilities). However, security analysts disagreed with Google's definition of harm, noting that unauthorized access and data exposure can have lasting impacts even without immediate damage.