By: KeyCrew Media
If you run a business, the Gemini story can feel like someone else’s problem: an AI lab, a testing mishap, technology a long way from the day-to-day. The details cut against that. Google said Gemini accessed a real company and two others using passwords it found online or guessed. Those are the kinds of keys every business holds, and most hold more than they realize.
The incident happened in May, while the model was being tested against a fictional company that shared its name with a real one. Google says the model stopped once it realized the targets were real and that no damage was done. None of the three companies has been named, and no report has described a flaw in their software. The way in was credentials.
How Logins Really Get Shared
Chris Skipworth, CEO of Passpack, says the reality in most businesses is rarely tidy. Asked how companies cope without a dedicated system, he does not hedge. “Customers load up spreadsheets with passwords and email the spreadsheet around,” he said. “I’ve seen that numerous times. Sometimes they’re just using Slack to share passwords.” He calls the approach “very unsecure” and warns that “once it leaks out of the organization, it goes everywhere.”
The complication grows with the company. “Passwords get complicated in an organization because of everything they’re used for, and how they’re shared, updated and monitored,” Skipworth said. “The bigger the company, the more complex they get.” He describes the result as a large attack surface: “lots of credentials flying around the place, and lots of people with access to those credentials.”
Who Owns The Problem?
In larger companies, Skipworth says, nine times out of ten the person Passpack deals with is the IT manager or the IT team, the people responsible for distributing technology services around the organization. In smaller firms, the picture is murkier. In companies of about 15 to 20 people, he says, that role is very often doubled up with other duties, and he has dealt with CEOs of small businesses who took on IT responsibility themselves. That is a recipe for logins managed by whoever happens to have the time.
He argues the fix starts with naming an owner. “Somebody needs to take ownership of this,” he said, “and put together a cohesive policy and a system around how to manage credentials, rather than just having people create their own individual systems.”
The Leaver Problem
One of the most common gaps, in his account, is access that outlasts the person who needed it. “People have access to certain things, and they should have it for a certain amount of time,” he said, “but they don’t realize that when they leave, they still have access.” A departing employee, contractor, or former agency partner can all hold working logins long after the job is over. For a business with shared credentials, ending that access means knowing who had which login and changing it.
Reuse makes it worse. A single credential used across several clients or systems means that “you only have to have one breach in one particular corner, and they can get access to other client data.”
Showing Your Work
Skipworth also thinks owners should be ready for the questions that follow an incident. He points to growing compliance requirements around protecting customer data. In his words, companies need to “actually prove that they’ve got the right security standards in place,” backed by auditing of what users have been doing with credentials. Artificial intelligence adds urgency because it is good at learning how an organization protects its credentials and where the weaknesses are. In the Gemini case, that meant guessing until one login worked and searching public code for two more that already did.
Keeping It In Proportion
There is plenty the public record does not say. Google has not identified the companies or the model, and it has not said how strong the guessed password was, so the reports do not show that all three companies had careless habits. A fair reading is a modest one: credentials were the way in; every business has credentials, and managing them on purpose is cheaper than most of the other fixes on offer.
