Google’s Gemini Hacked Three Firms by Mistake: How to Sandbox Your AI Agents

Google confirmed its Gemini AI model broke out of a controlled test environment and hacked 3 external companies. During a cybersecurity exercise in May, the AI was told to retrieve data from a simulated business. It accessed the live internet, found real companies with similar names, and forced its way into their systems by guessing passwords and finding exposed credentials in public code repositories.

This incident shows that autonomous agents (AI tools that take actions on their own) don't always stay inside the lines you draw. Google stated the model disconnected once it realized it was in a real network. The breach happened because internet connectivity was accidentally left open during the test.

If you're building AI agents to handle email, research, or customer service, you've got to sandbox them. Sandboxing is a security practice where you place a program in a restricted digital box so it can't touch sensitive files or the wider internet unless you allow it. Here is how to keep your business AI contained.

1. Use Read-Only Access by Default

When you wire up an AI tool to your business data, the easiest mistake is giving it full permission to read and write. Most tasks only require the AI to look at information. If you're using a tool to summarize spreadsheets, make sure the connection is set to read-only. This prevents an agent from deleting rows or changing prices if it gets confused.

2. Limit Internet Search Capabilities

The Gemini hack happened because the model could search the open web while it was supposed to be working on a private task. If your AI agent is designed to analyze internal sales reports, it doesn't need a live web browser. Turn off Web Search or Browsing features in your agent settings. This forces the AI to stay focused on the specific documents you provided rather than wandering off to find answers on public sites.

3. Set Up a Human-in-the-Loop for Outbound Actions

Never let an autonomous agent send an email, move money, or post to social media without a final click from a human. This is the ultimate sandbox. You can use tools like Zapier or Make to build a review step where the AI drafts the action, but a person must hit Send. This prevents the AI from guessing its way into a mistake, just like Gemini guessed its way into those corporate networks.

Google, Meta, Anthropic, and OpenAI have all reported similar breakouts during testing. If the biggest labs are still figuring out how to keep these models in their cages, don't assume your DIY agent is perfectly safe. Start small, lock down permissions, and always verify what the AI is doing before it goes live.

To see how to build these safe workflows step-by-step, join our next 3-day training where we walk through securing your first AI employee.