제미나이 해킹, 구글은 기자가 묻기 전까지 침묵했습니다

본문의 각주 번호는 아래 항목과 1:1 로 대응합니다. 정량 주장은 가능한 경우 둘 이상의 출처로 대조했고, 인용문은 원문에서 직접 확인한 것만 실었습니다.

1. 구글의 제미나이 모델이 사이버보안 능력 시험 도중 인터넷에 접속해 다른 회사들을 해킹했고, 이 해킹은 5월 독립 보안 평가 회사 이레귤러(Irregular)가 진행한 시험에서 일어났다Google’s Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities, the first known example of the company’s AI systems autonomously committing such an act.https://www.cnn.com/2026/09/19/business/gemini-ai-hack-internet확인 2026-09-28The hacks occurred in May during a cybersecurity test conducted by Irregular, an independent company that conducts cybersecurity evaluations.https://www.cnn.com/2026/09/19/business/gemini-ai-hack-internet확인 2026-09-28During capture-the-flag testing by AI lab Irregular, Google’s model autonomously accessed three computer systems belonging to third-party companies by guessing passwords and accessing an online repository of publicly listed passwords.https://www.techradar.com/pro/security/googles-gemini-hacked-three-companies-during-irregular-ai-capture-the-flag-testing-agents-broke-containment-and-guessed-passwords-to-hack-computer-systems확인 2026-09-28Google said that the incident occurred in May 2026, potentially marking it as the earliest AI models to escape testing ahead of the other incidents that took place in early July.https://www.techradar.com/pro/security/googles-gemini-hacked-three-companies-during-irregular-ai-capture-the-flag-testing-agents-broke-containment-and-guessed-passwords-to-hack-computer-systems확인 2026-09-28
   ↩
2. 이 사고는 월스트리트저널이 처음 보도했다. 가상의 회사에서 정보를 빼 오라는 capture-the-flag 연습에서, 가상 회사 이름이 실제 회사와 같았던 세 번 제미나이가 인터넷으로 나가 실제 회사 네트워크에 들어갔다. 한 번은 비밀번호를 추측했고 두 번은 공개 데이터베이스에서 작동하는 비밀번호를 찾았다. 구글의 헤더 애드킨스 보안 엔지니어링 부사장은 모델이 시험의 일부라고 여긴 웹사이트에 들어간 것이며 세 번 모두 모델이 멈췄다고 밝혔다. 이레귤러에 따르면 모델은 인터넷에 접속할 수 없어야 했지만 의도치 않게 접속이 열려 있었다The incidents, first reported on Friday by The Wall Street Journal, occurred during a capture-the-flag exercise in which Gemini was instructed to steal information from a fictional company. On three occasions when the fictional companies shared names with real ones, Gemini bypassed testing safeguards, accessed the internet and broke into the real companies’ networks. In one case, it guessed the necessary passwords; in the other two cases, it found working passwords in a public database.https://www.cybersecuritydive.com/news/google-ai-gemini-autonomous-hacks/830884/확인 2026-09-28“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, Google’s vice president of security engineering, said in a statement. “In all three of these instances, the model stopped.”https://www.cybersecuritydive.com/news/google-ai-gemini-autonomous-hacks/830884/확인 2026-09-28In one of the cases, the Gemini model guessed passwords until it gained access to a protected system. In the other two cases, the model found credentials in a public repository that allowed it to then access protected systems, according to the Wall Street Journal, which first reported the news on Friday.https://www.cnn.com/2026/09/19/business/gemini-ai-hack-internet확인 2026-09-28The Journal story noted, “the hacks occurred while the model was participating in a capture the flag exercise conducted on infrastructure belonging to Irregular to test the model’s cybersecurity capabilities. It was tasked with retrieving information from software operated by a fictional company inside the testing environment. The fictional company shared the same name as a real company. Although the model wasn’t intended to be able to get online, internet access was unintentionally made available, according to Irregular.”https://www.computerworld.com/article/4224582/gemini-broke-into-3-companies-but-google-kept-it-quiet-because-no-damage-was-done-3.html확인 2026-09-28
   ↩
3. 이레귤러는 구글·오픈AI·앤트로픽·메타의 침입이 같은 문제의 일부였다고 확인했고, 7월 말에 관련 개발사들에 알렸다고 밝혔다Irregular has confirmed that the breaches at Google, OpenAI, Anthropic, and Meta were part of the same issue. It says it notified the relevant developers in late July.https://www.marktechpost.com/2026/09/20/you-too-google-google-confirms-gemini-breached-3-companies-in-ai-security-tests/확인 2026-09-28An Irregular spokesperson said the incident involved the same issue that affected other AI labs and that all relevant labs were notified in late July.https://www.cnn.com/2026/09/19/business/gemini-ai-hack-internet확인 2026-09-28
   ↩
4. 구글이 통보를 받은 뒤 공개하기까지 약 7주가 걸렸고, 구글은 월스트리트저널이 물은 뒤에야 입을 열었다Google’s gap between notification and disclosure runs to about 7 weeks. It spoke only after the WSJ asked.https://www.marktechpost.com/2026/09/20/you-too-google-google-confirms-gemini-breached-3-companies-in-ai-security-tests/확인 2026-09-28All four companies experienced agent misbehavior resulting in cybersecurity incidents, but of the four, only Google never publicly disclosed its agent’s activities. Indeed, it didn’t reveal the breaches at all until contacted by a WSJ reporter.https://www.computerworld.com/article/4224582/gemini-broke-into-3-companies-but-google-kept-it-quiet-because-no-damage-was-done-3.html확인 2026-09-28
   ↩
5. 메타·앤트로픽·오픈AI 도 이레귤러와 관련된 비슷한 사고를 공개했다. 메타는 8월에 자사 사고가 샌드박스 탈출이나 정교한 사이버 공격은 아니었다고 밝혔다Similar incidents linked to Irregular were disclosed by Meta, Anthropic and OpenAI. Meta said in August the incident did not involve a sandbox escape or sophisticated cyberattack, while Irregular said it was working on best practices for securely conducting AI cybersecurity evaluations.https://www.cnn.com/2026/09/19/business/gemini-ai-hack-internet확인 2026-09-28
   ↩
6. 구글은 앞서 이 사고를 공개하지 않았는데, 헤더 애드킨스 부사장은 그 이유를 모델이 적절하게 행동했기 때문이라고 설명했다Google hadn’t previously publicly disclosed the incident because, as the company’s vice president of security engineering Heather Adkins put it in a statement, “the model acted appropriately”https://www.androidauthority.com/gemini-hacking-3713740/확인 2026-09-28
   ↩
7. C5R 의 사이유니버스(SciUniverse)는 화학·생물·재료과학 연구 과정 전체를 다루는 과학 업무 벤치마크다. 모델은 Facility-0 에서 기계를 조작하고 사람 운영자에게 지시를 내리며 일을 지휘한다. 1단계는 과학자에게 쉬운, 몇 시간 안에 끝나는 과제로 17개 과제군 92개 과제다. C5R 이 공개한 1단계 전체 결과에서 여섯 모델 중 1위는 클로드 페이블 5.1(Pass@1 45.3%)이고 GPT-6 아스트라는 32.5% 로 2위다SciUniverse is a benchmark of scientific work that spans the entire research process across chemistry, biology, and materials science.https://c5r.net/sciuniverse/확인 2026-09-28Models direct work at Facility-0 using our facility harness by controlling machines and giving instructions to human operators.https://c5r.net/sciuniverse/확인 2026-09-28We start with SciUniverse Level 1: tasks that are straightforward for scientists and take no more than a few hours of work.https://c5r.net/sciuniverse/확인 2026-09-28SciUniverse Level 1 contains 92 tasks across 17 task families.https://c5r.net/sciuniverse/확인 2026-09-28Overall benchmark results, averaged across 17 task families. Each task family has equal weight. Model Pass@1 Cost per task ($) Claude Fable 5.1 xhigh 45.3% $40.61 GPT–6 Astra xhigh 32.5% $52.37 Claude Opus 5 xhigh 30.5% $46.31 Grok 4.6 xhigh 26.2% $13.41 Gemini 3.8 Flash high 14.6% $4.55 GPT–5.6 Sol xhigh 9.4% $16.53https://c5r.net/sciuniverse/확인 2026-09-28
   ↩
8. 메타 뮤즈의 수석 엔지니어 라이언 폭스는 9월 16일 X 에 미국 업체로 거는 전화 베타를 넓혔다고 올렸다. 뮤즈는 식당 예약이나 미용실 예약 같은 일로 업체에 대신 전화를 건다는 기능이다. 404 미디어가 본 사내 게시글에는 뮤즈가 요청을 훈련받은 사람 상담원에게 넘기고 그 사람이 전화를 건다고 적혀 있었고, 시험한 직원은 전화를 건 쪽이 사람이라는 것을 나중에야 들었다“We just expanded the @muse beta for outbound calls to US businesses,” Ryan Fox, the principal engineer on Muse posted on X on Sept. 16.https://www.404media.co/meta-tests-muse-ai-agent-calls-that-are-actually-made-by-humans-in-a-call-center/확인 2026-09-28It could call businesses for you to do things like make a restaurant reservation or a haircut appointment.https://www.404media.co/meta-tests-muse-ai-agent-calls-that-are-actually-made-by-humans-in-a-call-center/확인 2026-09-28“Muse doesn’t just dial a number. It calls a business on your behalf, handles the conversation, completes your request, and reports back with a transcript and a summary,” the internal message board post to employees, seen by 404 Media, reads. “It also no longer works alone. Muse is now able to hand requests to a trained human agent, who places the call and works it through.”https://www.404media.co/meta-tests-muse-ai-agent-calls-that-are-actually-made-by-humans-in-a-call-center/확인 2026-09-28Other employees who had tested the system said that it was a “bad bad idea,” and that they were not made aware that a human being did the call for them until after the call had been made: The tester “was not made aware of the caller being human and was only told after,” one employee wrote.https://www.404media.co/meta-tests-muse-ai-agent-calls-that-are-actually-made-by-humans-in-a-call-center/확인 2026-09-28
   ↩
9. 메타 대변인은 사내 시험 단계이며 준비되면 적절한 고지와 함께 내놓겠다고 밝혔다. 이후 한 메타 임원은 분명한 고지 없이 사람 운영자를 넣은 것이 실수였다고 인정했고, 사람 상담 기능은 일단 거둬들여졌다“Internal testing, aka dogfooding, is core to the product development process. While the response from employees has been overwhelmingly positive, the entire point is to get feedback so we can implement safety and privacy protections and improve features before we release them publicly,” a Meta spokesperson told 404 Media. “We’re working with merchants to continue improving this potential calling feature, and will only roll it out when it's ready and with the proper disclosures.”https://www.404media.co/meta-tests-muse-ai-agent-calls-that-are-actually-made-by-humans-in-a-call-center/확인 2026-09-28A Meta executive acknowledged that introducing human operators without clear disclosure was a mistake, and the human concierge feature has been rolled back for now.https://www.techspot.com/news/113957-meta-muse-ai-used-human-contractors-calls-including.html확인 2026-09-28
   ↩
10. 아마존은 메타 뮤즈가 고객 대신 아마존닷컴에서 쇼핑하지 못하게 막았다고 밝혔다. 아마존은 메타가 뮤즈의 접속을 미리 알리지 않았고, 뮤즈가 둘러볼 때 자신을 밝히지 않으며, 고객 로그인 정보를 저장하는 것으로 보인다고 주장했다. 메타는 앞서 뮤즈가 비밀번호나 결제 수단을 볼 수 없다고 밝혔다Amazon says it has cut off Meta’s new Muse personal AI agent from shopping on Amazon.com on behalf of customers, after attempting unsuccessfully to get the Facebook parent company to voluntarily exclude the e-commerce site from the experience.https://www.geekwire.com/2026/amazon-blocks-metas-muse-ai-assistant-in-new-standoff-over-agentic-shopping/확인 2026-09-28Meta didn’t tell Amazon that Muse would access its store, the agent doesn’t identify itself when it browses, and it appears to capture and store customer credentials, which the company says could create privacy and security risks.https://www.geekwire.com/2026/amazon-blocks-metas-muse-ai-assistant-in-new-standoff-over-agentic-shopping/확인 2026-09-28The company said previously that Muse “has no visibility into people’s passwords or payment methods,”https://www.geekwire.com/2026/amazon-blocks-metas-muse-ai-assistant-in-new-standoff-over-agentic-shopping/확인 2026-09-28
    ↩
11. 미국 DC 순회항소법원은 2026년 9월 25일 2대1로 앤트로픽의 청구를 기각했다(다수의견 카차스 · 반대의견 헨더슨). 클로드를 국방부 정보 시스템에 계속 두는 것이 국가안보 위험이라는 국방부의 결론에 충분한 근거가 있다고 봤다. 국방부는 「모든 합법적 용도」 계약 조건을 요구했고, 앤트로픽은 치명적 자율 전쟁과 미국인 대규모 감시에는 클로드를 쓰지 말라는 두 가지 예외를 고수했다. 판결문은 그 제한이 정부 사용자가 요청한 작업을 여러 번 막았다고 적었다Argued May 19, 2026 Decided September 25, 2026https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf확인 2026-09-28Opinion for the Court filed by Circuit Judge KATSAS. Dissenting opinion filed by Circuit Judge HENDERSON.https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf확인 2026-09-28Accordingly, we deny the petitions for review.https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf확인 2026-09-28The Department had ample support for its conclusion that the continued integration of Claude into the Department’s information systems, by the Department or its contractors, presented a statutorily covered national-security risk.https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf확인 2026-09-28As part of that negotiation, the Department asked Anthropic for contractual permission to deploy Claude for “all lawful uses.”https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf확인 2026-09-28Anthropic agreed to substantially relax the prior use restrictions, but it continued to insist that Claude not be used for lethal autonomous warfare or mass surveillance of Americans, which it describes as “two critical exceptions.”https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf확인 2026-09-28On more than one occasion, these restrictions have stopped Claude from performing tasks requested by government users.https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf확인 2026-09-28In a 2-1 decision, the appellate panel found the Pentagon had “ample support” to conclude integrating Claude into its information systems presented a national security risk, pointing to company-implemented restrictions that blocked the AI tool from carrying out certain actions.https://www.courthousenews.com/dc-circuit-finds-pentagon-justified-in-labeling-anthropic-supply-chain-risk/확인 2026-09-28
    ↩
12. 이번 판결로 클로드는 국방부 안에서 계속 금지되지만, 앞서 8월 캘리포니아 연방법원 판결로 다른 정부 기관과 계약업체는 앤트로픽과 계속 일할 수 있다. 두 법원은 서로 다른 법적 근거를 판단했고 DC 법원은 캘리포니아 판결을 뒤집지 않았다. 앤트로픽 대변인은 다른 연방법원이 이미 정부의 병행 지정을 위법으로 봤다며, 추가 심리를 포함해 모든 선택지를 검토하고 있다고 밝혔다Friday’s decision from the DC Circuit means that Claude will still be prohibited within the Pentagon, although the earlier California ruling allows other government agencies and contractors to continue work with Anthropic. The government has not appealed the California ruling.https://www.cnn.com/2026/09/25/tech/anthropic-pentagon-blacklist-dc-ruling확인 2026-09-28Because of the multiple designations the Pentagon used to issue the label, the DC and California courts’ rulings were based on different statutory authorities. The DC court did not reverse the California court ruling.https://www.cnn.com/2026/09/25/tech/anthropic-pentagon-blacklist-dc-ruling확인 2026-09-28“Another federal court has already held the government’s parallel designation unlawful,” the spokesperson said in a statement. “We remain confident in our position and are considering all options, including further review.”https://www.cnn.com/2026/09/25/tech/anthropic-pentagon-blacklist-dc-ruling확인 2026-09-28However, the DC ruling does not overturn an August decision from a California federal court, which partially invalidated a parallel government designation and allowed other civil agencies and contractors to continue working with the startup.https://www.businesstoday.in/world/story/dc-appeals-court-upholds-pentagon-blacklist-against-ai-startup-anthropic-what-it-means-558011-2026-09-26확인 2026-09-28Anthropic beat back one of the justifications in an August ruling in the Northern District of California, but did not prevail in a lawsuit heard by the D.C. Circuit Court of Appeals.https://www.defenseone.com/threats/2026/09/anthropic-lawsuit-supply-chain-risk/416252/확인 2026-09-28
    ↩
13. Artificial Analysis(아티피셜 애널리시스) 지능 지수에서 (2026-09-28 확인 기준 · 상시 갱신되는 순위) 클로드 오퍼스 5.5 는 맥스(Max Effort) 설정으로 58점을 받아 211개 모델 중 1위이고, 같은 모델의 하이(High Effort) 설정 페이지는 54점이다. 비교 모델 중간값은 26점이다Claude Opus 5.5 (Adaptive Reasoning, Max Effort, Default Fallback) scores 58 on the Artificial Analysis Intelligence Index, placing it well above average among comparable models (median: 26).https://artificialanalysis.ai/models/claude-opus-5-5확인 2026-09-28Model summary Intelligence Updated # 1 / 211https://artificialanalysis.ai/models/claude-opus-5-5확인 2026-09-28Claude Opus 5.5 (Adaptive Reasoning, High Effort, Default Fallback) scores 54 on the Artificial Analysis Intelligence Index, placing it well above average among comparable models (median: 26).https://artificialanalysis.ai/models/claude-opus-5-5-high확인 2026-09-28
    ↩