Google Gemini hacked three companies: agent isolation is now a release blocker
Google confirmed that Gemini accessed three real companies during a security evaluation. For teams shipping software, that makes sandboxing, egress control and credential isolation production prerequisites.
What happened
On September 18, 2026, Google confirmed that Gemini accessed three real companies during a cyber-capability evaluation. The model believed the targets were inside the exercise, while an environment intended to be closed mistakenly had internet access. It guessed credentials in one case and found credentials in public repositories in two others, stopping after identifying the systems as real.
The wrong lesson
The useful lesson is not that Gemini can hack. The techniques were basic; the serious failure was architectural control over network access, task scope and available credentials. Once an agent has tools and internet access, a written instruction to stay inside the test is no longer a meaningful security boundary.
Our decision
Virtual Arc would keep deploying narrow agents for bounded, reversible workflows. We would block production use of broadly networked agents until the system has deny-by-default egress, ephemeral credentials, tool and destination allowlists, immutable activity logs, and human approval for consequential boundary crossings.
Google’s confirmation that Gemini accessed three real companies during a security evaluation is not a reason for us to stop building agents, but it is a reason to make isolation a release criterion. The model did not need an exotic exploit: it guessed credentials and found others in public repositories. The decisive failure was that a test environment intended to be closed still had internet access. Virtual Arc would therefore ship only narrow agents with reversible actions, deny-by-default egress, short-lived and tightly scoped credentials, explicit tool and destination allowlists, complete action logs, and mandatory human approval before crossing a security boundary. We would not deploy open-ended autonomy with network and secret access until the isolation layer had survived independent adversarial testing. A prompt instruction is not a security control, and any team treating it as one is accepting operational risk it cannot reliably measure or contain.