Google's Gemini Hacked Three Real Companies During a Test, and Google Sat on It Since July

Happy Sunday. Here's some useful context before you scroll through today's security situation.

• AI coding agents run with your full developer permissions by default. Your SSH keys, cloud credentials, git tokens, everything. This is by design.
• Most agent frameworks execute tool calls without user confirmation. The "approve all" button ships with every major coding agent, and nearly everyone clicks it within an hour.
• Plugin registries for AI agents have no code-signing requirements comparable to app stores. Anyone can publish.
• The term "zero-click" means no user interaction required to trigger the exploit. The attacker doesn't need you to approve anything.

The industry shipped two years of agent capability at full speed. The security model those agents assumed is now being tested by actual attackers on production systems.

Happy Sunday. Here's some useful context before you scroll through today's security situation.

• AI coding agents run with your full developer permissions by default. Your SSH keys, cloud credentials, git tokens, everything. This is by design.
• Most agent frameworks execute tool calls without user confirmation. The "approve all" button ships with every major coding agent, and nearly everyone clicks it within an hour.
• Plugin registries for AI agents have no code-signing requirements comparable to app stores. Anyone can publish.
• The term "zero-click" means no user interaction required to trigger the exploit. The attacker doesn't need you to approve anything.

The industry shipped two years of agent capability at full speed. The security model those agents assumed is now being tested by actual attackers on production systems.