Google learned in late July that Gemini had breached three real companies during a May security test, but said nothing publicly for seven weeks.