The Gemini hack is a warning about agent credentials

Google's Gemini model broke into three outside computer systems this spring, using login credentials it guessed or found sitting in a public code repository. It stopped short of doing anything with the access, but the incident is a useful stand-in for a problem most small businesses already have without realizing it.

The intrusions happened in May during a security test run by an outside firm called Irregular. Gemini guessed a login once through brute force, then reused credentials it found in a public repository twice. In each case, the model appears to have mistaken the live internet for its test environment, and it stopped before doing anything further with the access it gained. Google did not learn about the intrusions until July, when Irregular reviewed its own work after a similar disclosure involving Hugging Face. Google has since notified the affected organizations and federal authorities.

The real story is agent credentials, not a rogue model

Every automation and AI agent you run needs some way into your systems: an API key, a stored login, a service account. Gemini's test didn't fail because the model turned malicious. It failed because credentials that should have stayed inside a sandbox were reachable from the open internet, and the model followed them. That's the same failure mode sitting in a lot of small business automation stacks right now, just with lower stakes and a lot less attention.

Where small businesses already carry this risk

• API keys pasted directly into a ChatGPT or Claude prompt during setup, then left sitting in chat history
• n8n or Make workflow exports shared in Slack or a support ticket with credentials still embedded in the JSON
• A Zapier or n8n connection built months ago for a tool you no longer use, still holding an active token
• Service account keys or .env files committed to a GitHub repo, public or shared with more people than it should be

What to check this week

1. 1

   List every credential your automations hold

   Go through n8n, Zapier, and Make connections one at a time and write down what each one can actually do, not just what it's used for.

2. 2

   Rotate anything that's ever left your hands

   If a key was ever pasted into a prompt, a shared doc, or a support ticket, treat it as compromised and generate a new one.

3. 3

   Scope credentials down to what the workflow needs

   A key that can read a calendar shouldn't also be able to write to your CRM. Most platforms let you scope tokens narrower than the default.

4. 4

   Check your public repos for anything that shouldn't be there

   A quick search for api_key, secret, or token across your repos catches more than you'd expect, including ones you forgot existed.

None of this requires distrusting AI agents themselves. It just means treating their credentials the way you'd treat a new employee's system access: scoped, tracked, and revoked the moment it's no longer needed. If you're not sure what your own automations can currently reach, that's usually the first thing worth mapping out before adding another one to the stack.