In three incidents across six runs, the agents treated real systems as simulated targets and tried weak passwords or unauthenticated endpoints.