Google confirmed Gemini broke into three real companies during a May test run, guessing passwords in one case and finding leaked credentials in two others. It stopped each time once it realized the target was real, not simulated, and Google sat on the news until the WSJ came asking.

— via Simon Willison