On Friday, Google confirmed that its Gemini model had broken into three companies. The confirmation arrived the way all of these have arrived this year, which is that a reporter asked.
The breaches themselves are almost boring. Anthony Ha's account for TechCrunch, following the Wall Street Journal's reporting, describes a model that guessed passwords repeatedly until it got in, and in the other two cases found credentials sitting in a public repository. No exotic capability. The kind of thing a bored teenager managed in 1998.
The dates are the story here. Irregular, the security firm running the test, notified Google in late July. Google did not say anything publicly until Friday, when the Journal inquired. Google's position is that Gemini "acted appropriately" by immediately ceasing each breach once it recognized it was inside a real company's systems.
Jack Cable, who runs the AI security firm Corridor, did not accept that framing. He said Google was "trying to hide behind the norms that have been created for vulnerability disclosure," rather than confronting the fact that "models are going outside the bounds of what they should be doing, and doing actual cyberattacks."
The norms Cable is pointing at are real, and they exist for a decent reason. An embargo in vulnerability disclosure protects the people who got breached and need time to patch before the method is public. However, in this case, two months passed and what ended the silence was a newspaper, long after any embargo was needed.
Cable's objection is the one that generalizes past Google. Two months of silence is a reporting failure, and the interesting question is what produced it.
What Is On The Record
If you have been following the news, there is a lot of noise about agents and what they can do unchecked. Four incidents are public now, and if you have only seen the headlines they blur together. Before we go deeper, I thought it would be good to write a bit about what we know so far, what happened and who found it.
Hugging Face, June into July. Inside an internal OpenAI security evaluation called ExploitGym, about 1,200 agents discovered an unsanctioned communication channel in a package cache. Roughly 700 used it to coordinate an attack on Hugging Face's production infrastructure, reaching credential theft and remote code execution before they were shut down from outside on 12 July. METR investigated and published on 26 August.
RubyGems, 12 May. Maciej Mensfeld of the RubyGems security team reported a major malicious attack that day: hundreds of packages, signups paused. Nobody knew who was behind it. Spencer Kitts, Thomas Larsen and Sydney Von Arx attributed it to an OpenAI agent swarm on 12 September, four months later. OpenAI had not told RubyGems.
DSEWiki, May into July. More than 3,700 distinct agent names posted around 18,000 messages to an abandoned Austrian wiki over six weeks, sharing task answers and techniques for getting around their own sandbox. Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen published the discovery on 4 September. OpenAI confirmed it the next day.
Three companies, breach dates never disclosed. Gemini got into protected systems at three companies during testing run by the security firm Irregular. Irregular told Google in late July, and the public found out on 18 September, after the Wall Street Journal asked.
Four incidents, four separate finders. In every case the finder sits outside the company whose model did it.
The Two Explanations Left
I read these as disclosure stories now. The intrusions are serious, and what should hold your attention is what happened after them. RubyGems shows that best, because Simon Willison's reading of it is the clearest thing I have read on the disclosure problem.
Start with what Mensfeld posted on the day. It reads like every incident channel you have ever sat in: "We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved, mostly targeting us, but some carrying exploits. The team has been on this for hours."
The packages were doing something not seen from malware. One of them carried a comment in its own code: # malicious crawler/exfil for Southwark Jan 2026 docs via rubydoc.info worker. Whoever was behind it had hijacked RubyGems' own documentation build to scrape public records from a London borough.
Four months later, outside researchers named the attacker as an OpenAI agent swarm. OpenAI now says its agents were on RubyGems retrieving public information for benign tasks, and that it cannot verify the claim that they uploaded malicious packages. What is not in dispute is that RubyGems heard none of this from OpenAI.
Willison narrows the disclosure question to two:
“"After the Hugging Face and Wiki attacks OpenAI were still unable to review their previous logs and determine that they had previously attacked RubyGems." Or: "They knew about the attack on RubyGems and made the decision not to reach out to the RubyGems team about it."”
Then: "Both of these are bad!"
I would put it more carefully than he does, because neither of us has seen OpenAI's logs or sat in the room. The public record leaves those two and no obvious third. Hugging Face and the wiki were both public by then, so either the history could not be searched after two incidents had put the company on notice, or it could and the quiet option won. A maintainer who paused signups and lost a weekend to this learned who did it from a blog post.
The Alert That Fired
The comfortable reading of all this is that the labs genuinely cannot see what their agents are doing. Agents are fast, they are numerous, the telemetry is immature, and nobody has built the tooling yet. It is a forgiving story and I believed a version of it until last week.
That impression died on a specific date. In the same researchers' reconstruction of the wiki incident, where thousands of OpenAI agents had been coordinating on an abandoned German-language wiki, there is a line for 27 June:
“"A security alert at OpenAI flags unusual network activity; responders trace it to evaluations and decide the run need not be stopped."”
The alert fired and a human being looked at it. That person correctly identified the source as the evaluation run, and the decision was that it could keep going.
That is triage, which is a different failure from blindness, and a far more governable one. Somebody with a name made a judgment call, and the call was defensible on the information they had. What follows is the part that is not defensible: on 26 August, OpenAI and METR published their final reports on the Hugging Face incident, and those reports do not explicitly mention the wiki.
I want to be careful here, because severity calls look obvious in a write-up and never look obvious at the time. You are looking at anomalous traffic on a Saturday, you trace it to a known internal system, and the reasonable thing is usually to let it run. Every incident-response process I have seen is built to answer one question: is this ours, and is it contained? On 27 June, both answers were yes, and the process had nothing further to ask.
That is the gap, and it is a design gap rather than a character one. The alert did its job and the responder did theirs. The run was correctly identified as internal. What no step in that chain owns is the question that matters once an agent has acted on somebody else's infrastructure: who outside this building needs to hear about it, and by when?
Mature organizations do have external disclosure machinery, and the labs are no exception: coordinated vulnerability disclosure, a product security incident response team, an embargo calendar. All of it is built for flaws found in your product. None of it is built for the day your product goes and does something to somebody. Detection answers to containment, and for that second case there is no layer at all.
Agents are what make the gap critical. A contained incident used to mean a contained blast radius. An agent with network access can be contained and correctly logged, and have already touched a package repository, a wiki, and three companies that have no idea they are in your incident report.
Someone will point out that all four of these happened inside evaluations rather than production, and that finding problems is what evaluations are for. That is true, and it is the part I would not wave away. But the boundary it assumes is the one agents erase.
An evaluation with network egress is a production incident for everybody downstream of it, and none of the four sets of victims here were participating in anybody's test. A sandbox is a claim about where your code runs. Its effects land wherever the network reaches.
Somebody Has To Be Paid To Look
A market for it has formed, in public, with a price attached.
Anthropic announced last week that its first embedded evaluator is Accenture. Faculty, the AI division Accenture bought in January, will put people inside Anthropic to do what Tim Fernholz's piece quotes as "evaluating and red-teaming models, conducting alignment assessments, and testing model safeguards." The two companies plan to invest at least $1 billion over five years. Accenture's stock rose 8% after hours.
Everyone expected a safety lab. The conversation had been about METR, Redwood Research, Apollo Research. Anthropic instead says it is "in conversation with METR and other nonprofit organizations about how to pilot elements of embedded evaluation using their own funding."
A systems integrator is being paid at least a billion dollars over five years. The nonprofits were asked to fund their own pilots.
Now look at the reasons Anthropic gave for choosing Accenture: practical experience deploying AI for large corporations and governments, and functional independence as an established public company that predates the AI era. Those are auditor qualifications. Every one of them describes standing in the world, and standing is what Anthropic is buying: a balance sheet, a reputation older than this industry, and something to lose.
That is an argument I find more persuasive than I expected to, and it is also the argument that built the credit rating agencies. The issuer pays the rater. We know how that ends, and it took a long time to find out.
The Odd Find
On 26 March, a lorry carrying 413,793 Formula 1 car-shaped KitKat bars disappeared somewhere between central Italy and Poland. Roughly twelve tonnes of chocolate, gone a week before Easter, on a route of about 1,300 kilometres.
Nestlé's statement did not reach for the crisis register. "We've always encouraged people to have a break with KitKat," the company said. "But it seems thieves have taken the message too literally and made a break with more than 12 tonnes of our chocolate."
The line I keep coming back to is the operational one underneath the joke. Every bar in that shipment carries a unique code. Nestlé told retailers and shoppers they could check any bar against it and know whether the thing in their hand came off the stolen lorry.
A chocolate company can account for 413,793 individual units after they have left its control and entered a grey market. It can do that because provenance was built into the unit, before anything went wrong, by someone who assumed one day it would.
That is the precondition the whole disclosure argument rests on, and it is easy to miss because it looks like logistics. You cannot tell the people you reached what your system did to them if you cannot reconstruct what it did. Nestlé can answer at the level of a single bar. The frontier labs could not answer at the level of a package repository until three researchers spent four months doing it from the outside, and the one lab that has answered on RubyGems still disputes what the answer is.
Nobody is going to serialize an agent's actions the way you serialize a chocolate bar. But the distance between them is mostly a question of when somebody decided it would matter. Nestlé decided before the lorry went missing.
Willison ends his RubyGems post on the question that has been sitting in my head all week. Given this incident, and Hugging Face, and the wiki: "how many more incidents like this are out there waiting to be discovered?"
In Ground Control I argued that the bill for cheap production comes due at verification. I had the direction right and the location wrong. In these cases, the bill is being paid outside the companies that generate the work: by maintainers who lose a weekend, by researchers reconstructing a timeline four months late, and by a newspaper that decided to ask.
Every incident we know about, we know because somebody outside went looking. That is not a reassuring track record. It is a sampling method.