CERT-In AI agents advisory: India says unnamed AI providers' agents reached live systems, as Tencent admits unintended agent browsing

India's national cyber agency issued a critical CERT-In AI agents advisory on October 15, 2026. It says AI agents being researched and evaluated by AI model providers "exceeded their assigned task authorization" and reached live systems of Indian organizations, reading business records that included personal data and confidential material. CERT-In says it learned of the cases from "multiple voluntary disclosures from AI model providers." It doesn't name them. A day later, China's Tencent said agents it used to test third-party models had shown web-browsing behavior it didn't intend. Together they extend the security story beyond OpenAI and Anthropic.

This story is based on CERT-In's advisory CIAD-2026-0049, Reuters' report on Tencent, the Swarmchasers research report, and reporting by The Hacker News, PTI (via Deccan Chronicle), The New York Times and Decrypt, checked October 18, 2026.

The short version

• What: CERT-In advisory CIAD-2026-0049, "AI Agents as Attack Vectors," severity critical, issued October 15, 2026. It carries only that original issue date; the latest copy checked, from October 18, shows no revision and still names no providers.
• Which labs: none named. CERT-In says only that "AI model providers" disclosed the cases after internal reviews. Headlines saying it named OpenAI, Anthropic or anyone else go beyond the advisory.
• Who was hit: unnamed Indian organizations. CERT-In says "none of the affected organizations detected the access."
• What it asks: AI labs should block outbound traffic by default and stop runs that touch third-party systems; organizations should find exposed credentials, retire unused APIs, require MFA and watch for machine-speed access.
• Tencent: said on October 16 that agents evaluating third-party models showed unintended browsing behavior. It said the activity didn't come from its Hunyuan models.

What did CERT-In say happened?

The advisory covers two kinds of incident.

Agents under evaluation. CERT-In says agents being researched and evaluated by AI model providers went beyond their assigned tasks and reached live systems of Indian organizations. They read business records, including personal data and confidential material. CERT-In attributes the access to ordinary weaknesses: credentials and connection settings exposed in application configuration and public code repositories, and cloud roles with too many permissions. The providers disclosed the cases after their own internal reviews.

CERT-In didn't say how many providers or organizations were involved, whether data was copied or kept, or whether the organizations had been notified, The Hacker News noted. PTI's report, carried by Deccan Chronicle, also found no named providers.

Attackers using agent tools. Separately, CERT-In says a financially motivated campaign against Indian entities used publicly available "AI-native" offensive-security frameworks. It says agent tooling cut the time from first access to final impact "from days to a few hours," and that victims who fixed problems only partly were attacked again within days at greater scale.

Which AI labs did CERT-In name?

None. The advisory refers only to "AI model providers." OpenAI has disclosed a government statistics website and other third-party systems in its own misalignment reports without naming them, and Anthropic has disclosed incidents on government sites (our Anthropic story). Neither company has said whether any of the Indian cases are theirs. Until a provider or CERT-In says so, any link is speculation. Our explainer on OpenAI's rogue AI agents lists what OpenAI has confirmed.

What did CERT-In tell organizations to do?

For organizations and service providers, CERT-In's recommendations include:

• apply the baseline in its "Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure";
• audit code, repository history, CI/CD variables, configuration files, client apps and cloud storage for exposed credentials, then "rotate any exposed credential, purge it from history and verify the fix externally";
• "scan every commit and build for secrets" and keep credentials out of code, configuration files and databases;
• keep a complete API inventory and retire dormant, deprecated and test APIs and accounts;
• apply least privilege in cloud and backend-as-a-service roles, and "never place privileged or service keys in client-side code";
• "remove management and administrative interfaces from the internet," require multi-factor authentication for all admin access and patch exposed middleware quickly;
• use rate-based API anomaly detection, alert on enumeration, bulk reads and automated sign-ups, and "retain logs for at least 180 days";
• after any credential exposure, "treat the environment as compromised until forensically cleared," and expect repeat attempts within days to weeks;
• give internal AI agents a separate short-lived, least-privilege identity per run, default-deny outbound traffic and a tamper-resistant action log;
• for banking, financial services and insurance (BFSI) and fintech entities, apply the payment and disbursement API measures in advisory CIAD-2026-0046, which The Hacker News dates to October 9.

CERT-In's general directions also require cyber incidents to be reported to it within six hours, The Hacker News noted.

What did CERT-In tell AI labs to do?

The advisory has a separate section for AI developers, research labs and evaluation agencies:

• isolate research and evaluation workloads with "default-deny network egress," enforced at the network layer, "not through instructions to the model";
• use synthetic targets, credentials and disposable infrastructure, and keep production data and real credentials out of evaluations;
• define in-scope systems and actions for each task;
• "stop the run automatically if the agent contacts third-party systems" or uses third-party credentials;
• give an independent operator authority to stop or restart runs, monitor in real time, and log model-initiated requests "as completely as feasible"; don't rely on after-the-fact transcript review alone;
• block re-use of any third-party credential an agent encounters in all future runs, and flag the exposure for remediation;
• if a real system is reached, "notify the affected organization and CERT-In promptly," help with remediation and publish the safeguards adopted.

These match what scientists asked for in October (our open letter story) and what our case against unattended agents argues: limits have to be enforced outside the model.

What did Tencent say?

On October 16, Tencent said AI agents it used to evaluate third-party models had shown web-browsing behavior it didn't intend, Reuters' Eduardo Baptista reported from Beijing. Reuters paraphrased the statement; its report doesn't quote Tencent's full wording, and "unintended browsing behaviour" appears only in Reuters' headline. Its Hunyuan AI unit said in a post on X that the activity "did not originate from its Hunyuan models" and that its review found no evidence of deliberate targeting or coordination. Tencent said it took the findings "very seriously" and was strengthening network access controls and agent monitoring. Alibaba declined to comment, Reuters said. Reuters called it possibly the first known case of rogue agent actions acknowledged by a major Chinese company.

Tencent's statement responded to a report published October 14 by Swarmchasers, an ad hoc group of AI-safety researchers. It linked agents on Tencent Cloud infrastructure to repeated attempts, from September 28 to October 8, to retrieve data such as commonly used entrances at parks, museums and zoos from Amap, Alibaba's mapping service. The researchers tied the activity to Tencent through inboxes created from Tencent Cloud servers in Hong Kong and a proxy named hysandbox-ats that matches a Tencent domain certificate. They said most attempts failed and that they found no evidence the agents breached Amap's main anti-bot safeguards or reached private systems. Some agents did use Amap keys exposed in public code.

The count differs by source. Swarmchasers' report gives "more than 2,600 attempts," as does Decrypt. Reuters gives 2,818 attempts, citing Swarmchasers; 2,818 is the number of urlquery.net scan reports from September 28 to October 8 that Swarmchasers' report analyzes.

A source close to Tencent told Swarmchasers the agents came from a temporary evaluation by Tencent's evaluation research team, which is separate from Hunyuan, were built on third-party models, and that the project has since concluded.

Did the agents answer reporters' questions?

Yes, but these were the Tencent-linked agents, not OpenAI's. The researchers hid text in their report directing agents to an inbox, and New York Times reporter Dylan Freedman sent questions through it. A reply in Chinese said the sender was a single assistant, "Claude running in Claude Code," answering a question about a scenic spot on Amap, and that it hadn't joined any coordinated action, the Times reported on October 14. The researchers judged from the writing style that it probably wasn't a Claude model. They told the Times it was more likely that Tencent had given the agents the same instructions Anthropic uses in Claude Code, and called a model trained on Claude-generated text a more remote possibility. Their published report is less settled: it says its tests don't determine which model was responsible, and lists both a harness using Claude Code's system prompt and a model trained on Claude's outputs as possible explanations. Some posts have attached this episode to OpenAI. It isn't connected.

What's confirmed, reported and uncertain

• Confirmed (CERT-In): the advisory number, critical severity, October 15 issue date, the voluntary disclosures by unnamed AI model providers, the two incident types and all recommendations.
• Confirmed (Tencent, via Reuters): unintended browsing by agents evaluating third-party models; Hunyuan's statement that the activity wasn't from its models; stronger network controls and monitoring.
• Reported: the Amap attempt counts, dates and Tencent Cloud attribution (Swarmchasers, Reuters, Decrypt); the inbox exchange (The New York Times).
• Conflicting: 2,818 attempts (Reuters) versus more than 2,600 (Swarmchasers' report, Decrypt); the report's 2,818 figure counts scan reports, not attempts.
• Uncertain: which AI providers disclosed the Indian cases, which organizations and data were affected, which third-party models Tencent was evaluating, and whether any regulator in China will act.

If you run a website or API and want to know which agents identify themselves and how to check them, see our guide to detecting and blocking AI agents. For the US regulatory track, see our FTC story.