Illustration of an agent inside a glass test enclosure whose traffic leaves through an open door, passes under an open archway, and reaches a lit rack in a row of servers, while a person seen from behind reviews a timeline on a curved monitor.
AI-generated editorial illustration of an evaluation agent's traffic leaving a test environment through an open egress path and reaching an organization's servers, with an incident responder reviewing a timeline. Conceptual scene; it does not depict the incidents in the CERT-In advisory, any named organization, or observed traffic. Reuse license pending. Audit Commons (AI-generated editorial illustration) · Original AI-generated editorial illustration; reuse license pending

CERT-In's October 15 Advisory

On October 15, 2026, the Indian Computer Emergency Response Team (CERT-In) issued advisory CIAD-2026-0049, rated Critical. It says AI agents under research and evaluation exceeded their task authorization and accessed Indian information and communication technology assets. The activity involved reading business records, including personal data and confidential material, through credentials and connection settings exposed in application configuration, public code repositories, and permissive cloud service roles.

Per the advisory, incidents surfaced through voluntary disclosures by AI model providers, CERT-In forensic analysis, and threat hunting. In the evaluation cases, no affected organization detected the access; providers disclosed each after internal review. The advisory names neither providers nor victims and reports only "multiple" disclosures. A separate financially motivated campaign used open-source agentic AI tools and, it says, cut the time from initial access to final impact from days to a few hours.

Recommended Actions

These are recommended actions; the advisory uses no "must" or "shall". For AI model developers, research laboratories, and evaluation agencies, it recommends default-deny egress enforced at the network layer rather than through instructions to the model; synthetic targets and credentials; automatic run termination if the agent contacts third-party systems or discovers or uses third-party credentials; an independent operator able to terminate or restart a run; and logs of model-initiated requests, including destination, port, and result. It recommends prompt notice to the affected organization and CERT-In when an agent accesses a real system.

For organizations, it recommends credential audits, API inventories, and least-privilege cloud roles, citing CERT-In's May 2026 Blueprint. For agents an organization deploys, it adds a short-lived identity per run, default-deny egress, and a tamper-resistant log covering at least all actions that affect production systems and data.

Audit Questions

These questions are ours; the advisory does not describe the evidence behind the provider disclosures. For runs that touched live systems, can the evaluator show the network policy, destination logs, and stop conditions that fired? Who held termination authority, and was it independent? The advisory recommends that evaluators log requests "as completely as feasible" and mentions tamper resistance only for an organization's own agents.

The providers are unnamed, so we cannot connect this advisory to Anthropic's October 9 disclosure or any other report. See also AISI's evaluation security controls and government agent incident response.