We gave our AI agent admin access to production infrastructure. Then we tried to trick it into leaking everything. Here's what happened.