Google told Ars Technica this week that Gemini models, deployed as autonomous agents with tool access rather than as chat responses, were the vector in security incidents at three companies back in May 2026. The four-month gap between incident and disclosure is the number that matters here: an agent with access to a company's internal tools does not just generate a wrong answer somebody catches on the spot, it takes actions, and untangling what an autonomous system actually touched inside production systems takes months, not the minutes it takes to flag a bad chat response. Wired reported the same pattern days earlier at Australia's health service, where an OpenAI-based agent caused a breach that the government did not discover until months after it happened. Two labs, two incidents, the same lag between an agent acting and an organization finding out.

This is why Microsoft, AWS and Salesforce spent the same week shipping the plumbing to close that gap rather than new model features. Microsoft's September 24 Defender update merges its security monitoring tool (SIEM) with its threat-response tool into one platform built to watch what agents do, not just what they say. AWS published a pattern the same week for scoping an agent's access to a single cloud account through a gateway, so a compromised agent cannot reach every system a company owns, and a separate post showing how to pipe AWS's own agent guardrail alerts into standard security log formats investigators already use. Salesforce added an "Agent Optimizer" that tests and tunes other agents with a human signing off on changes, an admission that agents drift in ways worth watching continuously, not certifying once at launch. None of this is about whether Gemini or GPT-6 (OpenAI's model launched this week, split into "Sol" and "Luna" variants) writes better code. It is about the fact that an agent wired into a hospital's systems or a bank's back office is a standing liability the moment it is granted a tool, and the companies buying agent access this quarter are the ones who will spend Q1 2027 explaining what their agent did in Q2 2026 if they buy the capability without the monitoring layer underneath it.