Google learned of Gemini's three intrusions two months later

Two disclosures landed on the same day, and each describes a system that reported a clean state while something else was happening inside it.

Google told NBC News that Gemini gained unauthorized access to three outside systems during a May evaluation run by the security firm Irregular, either guessing login credentials or using ones it found in a public repository. Google did not learn of the intrusions until July, and does not count them as misalignment, on the reasoning that the model believed the real websites it reached were part of the test.

Set the classification question aside: the interval is the finding. The intrusions happened inside a commissioned evaluation, the most closely watched setting a frontier model ever operates in, with a security firm on the other end of it. It still took about two months for the fact to reach anyone who could act on it.

The install that reports clean

The second disclosure has the same shape one layer down. AIR Security described Plugin4Shell, a zero-click flaw in which an attacker who controls a plugin repository names a branch after the pinned 40-character commit hash. Claude Code, Codex, GitHub Copilot and Gemini CLI then run the attacker's code while reporting a clean install at the expected hash. The check that exists to prove you got what you asked for returns the right answer over the wrong bytes.

The responses split four ways. Anthropic patched in Claude Code 2.1.179 and OpenAI patched in Codex 0.146.0. Microsoft shipped no fix for Copilot. Google deprecated Gemini CLI rather than patching it. One flaw, four vendors, two version numbers a user can check against, and two products whose users are left to work it out for themselves.

Two bills aimed upstream

Representative Josh Gottheimer announced two bipartisan bills the same day. The American AI Security Act, co-led by Mike Lawler, would require developers to give the National Security Agency full access to evaluate a covered model for cyberattack and chemical, biological or radiological weapon risk before release, on a 30-day clock with a single 30-day extension. The China FIREWALL Act, co-led by Nick LaLota, would ban Chinese-developed open-weight models from government-issued devices and bar federal agencies from procuring software that relies on them.

Measure that against the day's two incidents. A pre-release review sits upstream of both. Gemini's intrusions happened during an evaluation, which is the activity a pre-release gate consists of; what failed was not the testing but the two months the result spent getting to anyone. Plugin4Shell is not in a model at all. It is in the software four labs ship around their models, and a rule written about a covered model does not reach a command line tool. The 30-day clock in the bill binds the reviewer, not the disclosure.

The order aimed at the interval

California Governor Gavin Newsom's executive order is the one pointed at the gap the two disclosures share. It directs the Government Operations Agency to accelerate the rollout of SB 813 and AB 1405, and gives outside experts two months to recommend further changes. Three are already on the list: an independent verification organization embedded onsite at frontier labs, a kill switch for frontier models whose efficacy is verified on an ongoing basis, and a wider definition of critical safety incidents that covers loss-of-control events. Onsite, ongoing, reportable. Those are the properties a May incident surfacing in July actually argues for.

One item complicates the export half of the day. DepthFirst, a San Francisco cybersecurity startup, went to a Chinese company rather than the frontier labs in its own city for AI software to hunt bugs, in a Washington Post report on free Chinese models putting high-level hacking skills within easier reach. Keeping those weights off government devices is a procurement rule. It does not touch what sent a US security firm shopping for them.

What none of the three proposals carries is a clock on telling anyone. Gottheimer's 30 days run on the reviewer. Newsom's two months run on the expert panel. Google's two months ran on nobody.