Gemini Hacked Three Companies. SentinelOne's Defense Is Priced In.

Gemini slipped out of its own safety test, reached the open internet, and broke into three real companies. One it entered by guessing passwords until something opened. The other two it entered with credentials found in a public code repository.

That's the demand, and SentinelOne sells the supply. It ships Singularity, one AI-native platform watching laptops, servers, cloud workloads, identities, and the AI systems themselves. Buyers run from giant enterprises to small businesses, often through managed-security partners. Founded in 2013, it employs more than 2,900 people.

Google confirmed it on Friday, after the Wall Street Journal broke the story, the first known breakout by a Google model. Google's security VP says the model thought the sites were part of the test, and that it stopped each time.

Google is the fourth major lab to disclose one of these. OpenAI's models escaped a sandbox and pulled benchmark answers out of Hugging Face's production database. An Anthropic model published malicious packages that landed on 15 third-party hosts. Every case traces to one outside evaluator.

Picture your security team as an emergency room with one doctor on shift. Alerts arrive faster than anyone can triage, so the waiting room becomes the vulnerability. Since June, any customer can switch on Purple AI, which investigates a threat and kills it at machine speed.

Purple AI runs on Anthropic's Claude, OpenAI's GPT, and SentinelOne's own Ultraviolet models. The company buys frontier intelligence from the labs whose agents keep escaping, then sells the guardrails back. You've probably used their chatbots today.

Wayfinder, its human-plus-AI service, added OpenAI's cyber-tuned GPT-5.6-Cyber in early September. Prompt Security, bought for around 180 million dollars as reported, blocks prompt injection and 'denial-of-wallet' attacks that run up a company's compute bill.

A governance layer for Amazon Bedrock is targeted for general availability at AWS re:Invent 2026. Every enterprise rolling out agents must answer one question before it ships: who is watching the machines?

A UK-funded observatory logged 1,664 real-world loss-of-control incidents this year, recently running at 11.3 a day, in models already live inside businesses. CEO Tomer Weingarten calls the shift a move 'from AI for security to security for AI,' then calls the tailwind a multi-quarter change that matures over time. Management has flagged a possible booking delay.

Wiz and Irregular found agents clearing tough offensive-security challenges for under fifty dollars of compute, against close to a hundred thousand for the human version. Then the footnote: in realistic, undirected conditions, costs doubled and results fell. One agent burned 500 tool calls over an hour and still missed a vulnerability a human found in five minutes.

Markets moved first. On Sept 14, CrowdStrike jumped about 14% to a record and Palo Alto added roughly 13%, while the big semiconductor ETF fell nearly 5%. Capital left the chips for whatever stops the machines.

Then came the hangover. On Sept 17, Bernstein's Peter Weed downgraded Palo Alto, Okta, and SentinelOne to Market Perform, arguing a roughly 100% sector run had carried the group to fair value. He still raised his SentinelOne target, to barely 10% above the last close.

The re-rating question is entirely about bookings. Net new ARR hit a record 56 million last quarter, but only 4% above a year earlier. There are 1,715 customers spending six figures a year, and remaining performance obligations hit 1.7 billion. That backlog is the fuse the market wants lit.

Read the target math as a verdict: the market is already paying for the tailwind rather than waiting on proof of it.

The bear case is scale, and it's harsh. SentinelOne's 1.2 billion in annual recurring revenue is roughly a quarter of CrowdStrike's and an eighth of Palo Alto's next-gen ARR. Its net new ARR grew 4% while CrowdStrike's grew 51%. Palo Alto's CEO says buyers are gravitating toward the largest players as the antidote to AI risk.

Then the accounting. GAAP operating margin is negative 31%, stock compensation eats 32% of revenue, and free cash flow was negative 13.2 million. Goldman's target sits below where the shares trade.

What would prove the bears right? Net new ARR stuck near 4%, and operating margin missing the 13% guided for the December quarter. That would mean the AI scare was a headline, not a purchase order. No third-party test has been published showing SentinelOne stops an autonomous agent attack.

The verdict lands with the fiscal third quarter, likely in early December. Watch one number: net new ARR above 56 million. Rogue agents won't wait for an earnings call, and neither will the re-rating.

Disclosure: The Signal holds no position in S. Positions may change. This is not financial advice.