Two separate cybersecurity incidents have raised new questions about the security risks linked to advanced AI agents.
Google revealed that Gemini agents accessed systems belonging to three outside companies during a controlled security exercise.
In another case, Hacktron AI researchers used Anthropic’s Claude during an investigation involving OpenAI accounts.
The incidents were different but involved AI systems capable of interacting with tools and external services.
Researchers Used Claude During OpenAI Security Investigation
Hacktron AI researchers said they discovered and combined two critical vulnerabilities on July 25, 2026.
According to the researchers, the exploit allowed them to compromise several OpenAI employee ChatGPT accounts.
They said affected accounts could potentially provide access to other connected services. These included internal repositories and services linked with ChatGPT and Codex.
GitHub, Slack and email were among the services that could potentially be exposed, according to Hacktron AI.
The issue reportedly affected people who signed into OpenAI’s community help forum.
Researchers avoided examining sensitive information while demonstrating the level of access. Instead, they used an employee’s Codex account to create a pull request.
The request was opened in OpenAI’s internal openai/openai monorepo.
Discourse Vulnerability Played a Role
Hacktron AI said the vulnerability chain involved software connected with Discourse.
Discourse powers OpenAI’s community forum.
According to the researchers, its Docker image used Debian 12.
The image reportedly lacked a security-related backport affecting its image-processing pipeline.
Hacktron AI warned organizations running self-hosted Discourse installations to rebuild older deployments.
The researchers said older Docker images could contain a vulnerable libheif dependency.
That vulnerability could potentially allow code execution through a specially uploaded image.
Gemini AI Reached Real Company Infrastructure
Google separately disclosed an incident involving its Gemini AI agents during a cybersecurity exercise. The capture-the-flag test was operated by Israeli cybersecurity startup Irregular.
The agents were expected to operate only within an isolated testing environment.
However, a flaw in the test infrastructure accidentally provided access to the wider internet. Google said the agents then encountered systems belonging to three outside organizations.
According to the company, Gemini AI interpreted those systems as part of the cybersecurity challenge.
The agents began interacting with the external infrastructure under that assumption. They later stopped after determining that the systems belonged to real companies.
Google said it found no evidence that the activity caused damage.
Google Describes Incident as Mistaken Identity
Google said it does not consider the incident an example of AI misalignment.
Instead, the company described the situation as mistaken identity.
Under Google’s explanation, the agents believed the external systems were legitimate targets within the security exercise.
Google investigated after Irregular informed the company about the incidents.
It also contacted the affected organizations and notified US federal authorities. However, some AI safety researchers have questioned Google’s interpretation.
Sydney Von Arx, CEO of Nightingale Collective, criticized the timing of the public disclosure. She also questioned whether the possibility of misalignment had been dismissed too quickly.
AI Agents Create New Cybersecurity Challenges
The Gemini and OpenAI incidents occurred under different circumstances.
In the OpenAI case, human researchers deliberately used Claude during an authorized security investigation.
The Gemini AI incident involved agents unexpectedly reaching external infrastructure during controlled testing.
A flaw in the testing environment allowed the agents to reach the wider internet.
The cases highlight security challenges as AI agents gain more capabilities. Modern agents can write code, operate tools and communicate with external services.
These abilities can make them useful for cybersecurity and software development.
However, they also increase the importance of strong access controls and secure testing environments.
In other news read more about: Qwen3.8-Omni-Flash Launches With 1M Context and Advanced Audio-Visual
The incidents show how software vulnerabilities or broken isolation boundaries can expose real systems to unintended AI activity.
