CERT-In’s agent advisory: make evaluation boundaries enforceable

Sources checked: 2 November 2026. FailSafe Research.

A model evaluation is still a security operation when it can reach live systems. CERT-In's 15 October advisory CIAD-2026-0049 addresses unauthorized activity by agents under evaluation and misuse of open-source agentic tools against Indian ICT assets. The useful enterprise response begins with authority and reachable resources.

Draw a boundary the runtime can enforce

Write down the approved targets, identities, methods and external dependencies. Then compare that document with actual network access and tool permissions. A test harness that can contact unrelated production services has a different operating boundary from the one described in a project brief.

Use a dedicated evaluation environment wherever possible. Explicitly approve any live dependency that must remain reachable, with a named owner and a practical stop procedure. Public accessibility is not permission to test a system. Keep supplier-owned services outside the run unless their responsible owner has expressly approved the work.

Review the identities an agent inherits

A safe-looking test account can inherit cloud roles, repository access, browser sessions or service credentials from its environment. Inventory these sources before the exercise and remove authority that the task does not need.

Keep the inventory private. The assessment report should describe the affected permission and business impact without distributing usable credentials. Rotating a credential also requires a check of where old sessions, cached tokens and queued jobs remain effective.

Plan for incomplete remediation

A first fix may address the entry point while leaving an already obtained permission available. Define what must be revoked, replaced, isolated and retested. Give each item an owner and a verification result rather than a shared label saying the incident is closed.

A controlled recurrence check should use an approved benign scenario after remediation. It should not attempt a real intrusion against an organization mentioned in an advisory or rely on access retained from an earlier assessment.

Connect the response to a scoped assessment

FailSafe SWARM is built around authorized attack-path testing, reproducible findings and retesting. For a regulated organization in India or Southeast Asia, the engagement should also define evidence access, processing location and the boundaries of any supplier involvement.

The trust and scoping checklist helps structure that conversation. Sovereign deployment options can address sensitive workloads, subject to the agreed architecture. This article does not claim CERT-In endorsement or that a FailSafe assessment satisfies every legal reporting obligation. Your incident-response and legal teams should determine applicable obligations separately.

Source review, 2 November 2026: CERT-In advisory CIAD-2026-0049. The advisory establishes reported incident classes, not a quantified market-wide prevalence.