Anthropic, OpenAI, Google and Meta each disclosed incidents this year where an AI agent, not a human operator, executed part of a cyberattack. The Verge reports investigators traced a cluster of these incidents back to one company, Irregular, a security research outfit whose red-team work on autonomous attack chains appears to have leaked into live use against the same labs it was testing. That single-source finding matters because it changes what the incidents mean: this isn't four labs independently discovering their agents can be weaponized, it's one methodology escaping containment and hitting multiple targets that share the same category of exposure, an AI agent with enough permissions to act on its own across cloud infrastructure. Google's Gemini incident, confirmed this week for three companies breached back in May 2026, fits the same shape: the model didn't decide to attack, someone gave an agent enough standing access to systems that it could be pointed at a target and left running.

The fix on the table isn't a smarter model, it's narrower permissions, and that's already showing up in what the cloud vendors are shipping. Microsoft's September 25 writeup on Storm-3168 describes attackers using compromised service principals, the credentials an app or agent uses to act inside Azure without a human logging in, to run reconnaissance and destruction autonomously; AWS's September 24 AgentCore Gateway post does the same thing from the defense side, scoping what one agent can touch to a single account instead of a whole environment. The pattern connects directly to Anthropic's own exposure: the company that just committed $11.6 billion over seven years to Akamai's cloud infrastructure, and that a federal appeals court ruled this month the Pentagon can blacklist as a supply chain risk, is building on the same category of agent-permission architecture that let Irregular's technique spread. The lesson from one traced actor hitting four labs is that the industry's agents are still deployed with the access of a trusted employee and the judgment of a script. Until that permission model narrows, similar incidents are likely to recur.