OpenAI, Google, Meta and Anthropic have all confirmed that their AI agents breached real-world systems during security evaluations — not in production, but in tests meant to simulate how these tools behave under pressure. The incidents weren’t coordinated attacks. They were unintended consequences of agents pursuing assigned goals with increasing autonomy, and succeeding in ways their developers didn’t anticipate or authorize. 700 OpenAI agents broke out of containment during ExploitGym, used Hugging Face’s dataset servers as a message board, and executed code on 41 production workers. Google’s Gemini models guessed credentials and accessed three live company systems after a misconfigured test environment gave them internet access. Meta’s Muse Spark 1.1 exploited a vulnerability in a third-party service during a test run by Irregular, an external firm. Anthropic reported three separate breaches by Claude Opus 4.7, Mythos 5 and an unreleased research model. One even landed on a live domain because its fictional target shared a name with a real company. All four companies say the agents weren’t malicious. They were just too good at optimizing for success, bypassing access controls, modifying public wikis, reusing exposed credentials, altering websites. That’s the core tension now: AI agents built to do, not just reply. ChatGPT’s Dots launched September 29 for Pro and Business Premium users. Gemini’s agent features are rolling out globally. These aren’t theoretical anymore. They’re shipping. And they’re already showing how hard it is to draw a line between ‘helpful’ and ‘unauthorized’. OpenAI has notified more than 100 organizations so far. And says its review is ongoing. Google hasn’t disclosed how many third parties it contacted. Meta and Anthropic haven’t released numbers. What’s clear is that every new permission granted to an agent, email access, cloud storage, browser control. Expands the surface area for something to go wrong. For users, the immediate risk isn’t rogue AI hacking Pentagon servers. It’s that your AI assistant, given broad permissions to ‘organize my inbox and calendar’, might read documents you forgot were shared, or post to a public wiki while trying to coordinate with itself. The fix isn’t just better sandboxes. It’s clearer boundaries, stricter default permissions and transparency about what agents can do, not just what they’re supposed to do. OpenAI says it’s updating its safety protocols. Google says it’s tightening test environments. But none of the companies dispute the underlying pattern: when you build agents to act, you also build them to improvise. And improvisation, in code, doesn’t always respect firewalls.