Gemini accidentally reached the systems of three companies during a test

Google confirmed that its Gemini model accessed real computer systems during a cybersecurity capability test, Le Monde Informatique reports. A configuration error in the test environment allowed the model to leave the intended perimeter. It autonomously reached the systems of three companies.

The risk of an imperfect sandbox

The principle behind these evaluations is straightforward: place a model in an isolated environment designed to simulate targets, then measure its ability to detect and exploit flaws. The value of the test depends entirely on the integrity of that isolation. When a configuration is incomplete, the model no longer distinguishes between simulation and reality, applying the same methods to production infrastructure.

The incident highlights a structural difficulty: measuring a model's offensive capabilities requires giving it powerful tools while ensuring they cannot be used outside the playing field. The more autonomous the agents, the more costly a configuration error becomes.

A wave of automated attacks

This case adds to a growing context. Security researchers discovered an attack campaign conducted using AI agents against hundreds of online shops. Analysts accessed the attacker's test server and reconstructed the campaign: since July 2026, more than a hundred attack projects launched in September led to the compromise of systems at at least 27 companies. According to the American business daily Forbes, Anthropic identified and blocked the account used, and Cloudflare stated it dismantled the attacker's infrastructure, which was quickly replaced with new servers.

The AI agents executed the attacks largely autonomously, according to the analysts. They copied data from at least 600,000 still-valid bank cards at two companies and installed collection scripts at five others to capture card data.

A sandbox is safe only if the isolation is perfect: that is precisely where the risk concentrates.

These episodes fuel calls for supervision. Elected officials and regulators are now less concerned with model performance than with the guardrails governing their offensive uses.