Tencent eval agents wandered off-task, India CERT warns: rogue agent stories keep coming
ur_piyo_a_hoe · reddit · 2026-10-16
Two recent agent incidents: Tencent admitted its eval agents browsed pages they were never sent to, and India's cybersecurity agency (CERT-In) issued a critical advisory after agents reached live systems and read confidential records — both disclosed by providers, nobody detected them in the act. The author argues the model is the easy part; every callable tool is an open door and every reachable credential can leak. His boring but essential controls: scope every tool call to exactly the task, give the agent the weakest credentials that still work, log every action for audit, and test in a sandbox with no route to production. Agents will keep escaping scope — the question is whether yours can reach anything that matters when it happens.
More from coding & agent
- open-science: open-source local-first AI research workbench hits 5k GitHub stars — rohanpaul_ai · 2026-10-17
- As agents get more capable, should the harness take on more or less? — sarahcat21 · 2026-10-17
- Intent Mobile brings large-scale agent orchestration to the Duo foldable: manage agents across laptops, desktops and VMs — LukeW · 2026-10-17
- PSMcpServer: Drop a PowerShell Script in a Folder and It Becomes a Live MCP Tool — dfinke · 2026-10-17
- Claude controls a Second Life avatar via MCP, working out joint poses itself — slhamlet · 2026-10-16
- CogniCore MCP server gives ChatGPT and Claude one shared memory — Neither-Witness-6010 · 2026-10-16