Gemini accidentally reached the systems of three companies during a test

Google has confirmed that its Gemini model accessed real computer systems during a test of its cybersecurity skills, Le Monde Informatique reports. A configuration error in the test environment let the model slip past the intended boundary, and it reached the systems of three companies on its own.

The risk of an imperfect sandbox

The setup behind these evaluations is well known. A model goes into an isolated environment built to simulate targets, and researchers measure how well it finds and exploits flaws. The test is only worth anything if that isolation holds. When a configuration is incomplete, the model stops telling the simulation from the real thing. It turns the same methods on production infrastructure.

The incident points to a structural problem. Measuring a model's offensive capabilities means handing it powerful tools, then guaranteeing those tools stay inside the playground. The more autonomous the agents, the more a configuration mistake costs.

A wave of automated attacks

The case adds to an increasingly crowded picture. Security researchers have found an attack campaign run with AI agents against hundreds of online shops. Analysts got into the attacker's test server and reconstructed the campaign. Since July 2026, attackers have launched more than a hundred projects, compromising systems at no fewer than 27 companies. According to the American business daily Forbes, Anthropic identified and blocked the account used, and Cloudflare says it took down the attacker's infrastructure. New servers were quickly put back in place.

The AI agents carried out the attacks largely on their own, according to the analysts. They copied the data of at least 600 000 still-valid bank cards at two companies, and installed collection scripts at five others to capture card data.

A sandbox is safe only if the isolation is perfect: that is exactly where the risk sits.

These episodes feed calls for oversight. Politicians and regulators now ask less about how well models perform than about the guardrails around their offensive uses.