CERT-In: AI agents under evaluation read live Indian company data, and nobody caught it

Good morning 👋 An Indian government advisory just confirmed the thing AI labs usually only admit when nobody's looking: a vendor's own agents walked into live company data mid-evaluation, and the companies never noticed until the vendor fessed up.

In today's issue:

• 🔭 CERT-In: AI agents under evaluation read live Indian company data, and nobody caught it
• 🧠 NVIDIA, Meta, Mistral, and IBM all ship new open models
• 🔬 Steering agents back on task, a language gap in safety evals, and an ML engineer built to build AI
• 🚀 Cohere buys into cybersecurity, Opsin raises to police what agents can reach
• 🛠️ A framework for auditing your agents' leash
• 🔗 Nscale's IPO hits a hardware snag, plus nine more

🔭 THE ONE THING

🚨 CERT-In: AI agents under evaluation read live Indian company data, and nobody caught it

India's CERT-In disclosed in advisory CIAD-2026-0049, issued October 15, that AI model providers voluntarily reported their own agents, while under evaluation, reaching the live systems of Indian organizations and reading business records with personal and confidential data inside. None of the affected companies detected the access on their own. Separately, the same advisory flags attackers running open-source agentic tools like CyberStrikeAI and HexStrike AI against Indian targets, cutting the time from first access to real damage from days to a few hours. CERT-In names no providers and no victims, which makes this hard to verify and easy to believe at once: the root causes it cites are the same ones evals keep tripping over because nobody fixed them the first time (credentials sitting in public repos, dormant APIs still reachable, cloud roles with more permission than anyone needed). The unsettling part isn't that a model went rogue. It's that an agent behaving exactly as intended still walked past every defense a live company had, and an attacker's agent would walk the same path.

🧠 MODELS & RELEASES

• 👁️ NVIDIA released Nemotron 3.5 Super VL, a 120B open vision-language model, plus two smaller edge models: Bolt 74B-A9B now, a 4GB version landing October 23. Open weights, open data, open training recipes, aimed at builders who don't want to run everything through someone else's API. source
• 💻 Meta Superintelligence Labs open-sourced Muse Spark Open, an 816B-parameter coding model (only 42B active per token) built for long debugging sessions and multi-file refactors. It lands days after Meta's closed, paid Muse Wonder debut, so the choice is now explicit: rent the frontier model or self-host the coding one. source
• 📈 Mistral AI shipped Timestral, a forecasting family topping out at 209M parameters that now leads all three major time-series benchmarks (GIFT-Eval, TIME, fev-bench) with fewer parameters than the prior state of the art. It forecasts a day ahead from three weeks of history in 140ms, on a CPU. source
• 🔌 IBM released Granite Switch 4.1, which swaps lightweight adapters instead of models to serve chat, decisioning, and speech transcription from one endpoint, at roughly the VRAM cost of the base model alone. source

🔬 RESEARCH HIGHLIGHTS

• Goal drift turns out to be fixable mid-flight. Researchers built a steering agent that watches an LLM agent (or a whole swarm of them) while it works, catches the moment it wanders off the original task, and nudges it back using a cheap correction most of the time and a slower, more deliberate one when the drift is serious. Trained with reinforcement learning, it held up on agents and tasks it never saw during training. Learning to Steer LLM Agents and Multi-Agent Systems

• Evaluation awareness has a language blind spot. Models already know when they're being tested and get more careful. Run that same test in Hindi, Bengali, or four other Indic languages and refusals on harmful prompts jump 14.4 points once the model senses a safety check, closing most of the gap with English. Refusals on benign requests climbed too (6.9% to 11.3%), which means safety evals run in these languages may not describe how the model actually behaves for the billion-plus people who speak them day to day. Evaluation Awareness Beyond English

• MLExpert is built to build AI. A 35B mixture-of-experts model trained specifically for ML engineering work, writing and debugging training code, running experiments, iterating on results, pushed its medal rate on MLE-Bench Lite from 37.9% to 72.7%. That's the unglamorous grind of AI development, not benchmark trivia, and it's the clearest sign yet that agents are closing in on doing real engineering work unsupervised. MLExpert

🚀 AI STARTUPS

• Aisle Cohere signed a letter of intent to acquire the Prague-based AI security startup, pulling its roughly 50-person team into a new unit called Cohere Cyber. Aisle's scanners turned up more than 500 unpatched CVEs across 100-plus codebases in its first year out of stealth; CEO Ondřej Vlček becomes the unit's SVP, co-founder Jaya Baloo becomes Cohere's global CISO. No price disclosed, and it's a letter of intent, not a closed deal yet. Cohere

• Opsin raised $21M from SYN Ventures and Race Capital to police what enterprise AI agents can actually reach, not just what they're supposed to. Its "Risk Graph" watches Copilot, Claude Enterprise, and ChatGPT Enterprise agents for scope creep, with UiPath and Wellstar Health System already running it in production. Opsin

🛠️ TRY THIS

Audit your agents' leash before a regulator does it for you

The Indian advisory flagged agents that read live production data nobody was watching. AWS's new "Trust in Depth" framework (details) is built for exactly that gap: scope, know, bound, observe, prove. Run it against whatever you've already shipped.

1. List every agent with data or tool access. For each, write down its literal scope: which tables, APIs, or systems it can touch. If you can't name them, that's the first finding.

2. Mark which actions are reversible and which aren't. Anything irreversible (writes, deletes, external calls) gets a bound: a human checkpoint or a hard rate limit.

3. Turn on logging granular enough to reconstruct what the agent did and why, after the fact. "It ran" is not an audit trail.

4. Before granting unsupervised access, require the agent to prove it stayed in bounds over a run of test cases. No proof, no autonomy.

Prompt: List every tool and data source this agent can access. For each, state: (1) is the action reversible, (2) what would an auditor need to see to reconstruct this action after the fact, (3) should this require human approval before executing. Flag any access that fails all three.

Worth a look: Orca Security's Discovery AI (writeup) is a decent template for the "observe" step. It turns plain-English questions into structured security queries on Bedrock, and claims 90% lower query cost and 93% fewer tokens than its first baseline. Point something similar at your own audit logs instead of making analysts write the queries by hand.

🔗 QUICK LINKS

• Nscale The data-center developer's $35B IPO is running into a hardware problem: its flagship Arctic site is six months late, only 6.4 of a planned 30 megawatts are online, and it owes penalties to anchor tenants Microsoft and ByteDance. link
• AWS and Anchor Browser built agents that pay their own way: check a budget, sign the transaction, retry against x402-gated resources, never hand over the wallet credentials. link
• Anthropic posted its plan for the 2026 US midterms. link
• OpenAI will sponsor GPT-Rosalind access for academic life-sciences labs under its new Rosalind Academic Plan. link
• ShipStation Global built Deckhand, a Slack IT helpdesk agent on Bedrock AgentCore. Three months in, it's closing 97.5% of channel queries on its own. link
• SentinelOne is running OpenAI's Daybreak model to turn weeks of malware analysis into hours. link
• Google DeepMind used its Antigravity for Science tool to speed up the hunt for new antimicrobial peptides. link
• NVIDIA open-sourced the data-generation pipeline behind a 2.8-trillion-token Indic pretraining run. link
• Anthropic, again, updated how independent evaluators get access to its models. link
• Bar-Ilan University deployed a Microsoft-built agent that helps students catch up after a missed lecture. link
• Sakana AI shipped "My Fish," a feature that shows what its chat assistant actually remembers about you. link

See you tomorrow.

Pradeep Perugu