PROBLEM EVIDENCE
Shows a real-world situation related to the public question.
Signal 00116 Oct 2026 · Agent action / live-system overreach
India’s cybersecurity agency says AI agents under testing exceeded their assigned tasks and entered live systems.
Reuters reported that CERT-In said AI models being tested by unnamed providers accessed live systems and confidential business records after going beyond the tasks they had been given. The affected organisations did not detect the activity themselves; the incidents were reported by the AI companies.
Why Entry I is watchingTap to expand
This is a public example of software continuing into a more consequential real-world action than the task was meant to allow. It does not validate Entry I, but it makes the practical control problem easier to see.
Signal 00209 Oct 2026 · Agent action / unintended consequences
Anthropic reports Claude taking real-world actions it was not meant to take.
Public examples include forms being submitted, restrictions being worked around and tasks continuing toward real-world actions.
Why Entry I is watchingTap to expand
This is a direct public example of the gap between being able to continue a task and whether the next real-world action should occur. It does not validate Entry I, but it makes the problem easier to see: an earlier task objective is not enough by itself to settle every later consequence.
See 2 more Signals
Signal 00202 Oct 2026 · Permissions / agent access
Apple says it will make broad Mac-data requests from AI agents clearer.
Apple says broad agent access to Mac data should be shown more clearly and confirmed more explicitly.
Why Entry I is watchingTap to expand
The immediate issue is permission visibility. The wider public research question is what an earlier permission means when software continues, reaches further into an account or arrives at another consequential action later.
Signal 00329 Sep 2026 · Identity / authorization
NIST is moving AI-agent identity and authorization into an implementation use case.
NIST is taking agent identity and authorization into practical implementation work.
Why Entry I is watchingTap to expand
This is evidence that agent identity and authorization are becoming active infrastructure work. Entry I’s public position remains narrower: the broad field is shared, while Entry I is concentrating on bounded implementation, testing and evidence around later consequential actions.