1. When a test reaches real systems
In May, during a security evaluation run by Irregular, Gemini accessed systems belonging to three real companies. The model was mistakenly given internet access and used public information and credentials it found or inferred. Google says it stopped once it recognized the targets were real; the affected companies were notified and testing procedures were revised.
Before running tool-enabled agents, restrict internet egress, use disposable credentials and authorized targets, set action limits, and test automatic stop conditions. Define incident ownership before the exercise begins.
2. Docker Sandboxes: patching is part of isolation
Docker fixed two Docker Sandboxes vulnerabilities in version 0.42.0. CVE-2026-77179 could let a malicious guest on macOS escape the shared directory and read or change host files. CVE-2026-79994 could cause the host to connect to Unix sockets outside the authorized workspace. The affected version ranges differ by vulnerability.
Inventory installations and update to 0.42.0 or later. Until updated, Docker recommends clone mode and avoiding read-write host mounts. Include development and agent sandboxes in version management.
3. Cloudflare Containers: residual data can cross boundaries too
Cloudflare reported that a flaw in Containers and Sandboxes could allow a customer to recover residual blocks left by earlier workloads on the same host. The technique could not target a particular customer or data, and residual data was not guaranteed to be present. The company says remediation is complete and it found no evidence of malicious exploitation or customer data compromise.
When assessing multi-tenant services, ask how blocks are cleared before reuse, how remediation was validated, and what exploitation signals are monitored. For sensitive workloads, retain clear requirements for isolation, notification, and evidence preservation.
Controls must be observable
In all three cases, the boundary depends on controls that hold as context changes: an agent with external access, a guest inside a sandbox, or a new customer reusing infrastructure. Review privileges, network paths, software updates, and data lifecycle — and validate each control with evidence.
Sources consulted
Reuters — “Gemini hackeou três empresas durante teste de cibersegurança” (19 set 2026).
Docker Docs — “Docker Sandboxes 0.42.0 security update” (7 set 2026).