HCLTech-MIT Research: Agent Discovery Infrastructure Exposes Systemic Governance Gap
What happened
HCLTech's VP of Responsible AI and MIT Media Lab researchers published Building a safer agentic web: NandaIndex and the HCLTech-MIT Media Lab collaboration on November 6, 2026. The publication describes NandaIndex as a discovery protocol that lets AI agents find and interact with other agents across separate organizational environments. The companion paper, 'Economic and Systemic Considerations in Agentic Web Systems,' won the Best AI Research Paper Award at The AI Awards 2026 in London. The research positions NandaIndex within the discovery phase of an Agentic Transaction Lifecycle, covering how agents locate one another before transacting. Critically, the authors state that NandaIndex itself does not resolve systemic safety challenges. It provides a foundation on which monitoring, incident learning, and accountability infrastructure will need to be built. The research explicitly warns that individual-agent safety controls are not sufficient once agents coordinate, transact, and interact across organizational boundaries at scale.
Why it matters
- ·Enterprise AI governance programs are largely designed around individual model deployments. When agents discover and interact with agents operated by other organizations, existing controls for permission boundaries, audit trails, and human oversight may not apply. This leaves accountability gaps that regulators are beginning to probe, as seen in the ICO's agentic AI data protection probe and guidance under the Five Eyes Guidance on the Careful Adoption of Agentic AI Services.
- ·Cross-organizational agent interactions create a shared accountability problem. When two agents from different enterprises coordinate and something goes wrong, neither organization's incident response program may have visibility into the full chain of events. This mirrors the multi-agent delegation and audit-trail gaps flagged across recent research and enforcement signals.
- ·Discovery infrastructure like NandaIndex expands the attack surface for prompt injection and agent manipulation. Malicious or misconfigured agents could be surfaced to enterprise agents during discovery. This makes the integrity of the discovery layer itself a governance control point that most organizations have not yet assessed.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Containment failures across AI agents, vendor privacy rollbacks, and deepfake fraud show that unverified trust in AI systems is now a measurable financial liability.12 Nov
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your AI and engineering teams whether any deployed agents can discover or initiate interactions with agents operated by third parties, and document which systems enable that cross-boundary discovery.
- ☐Review existing multi-agent audit trail controls to confirm they capture agent-to-agent interactions that originate outside your organization's environment, not only internally initiated actions.
- ☐Add cross-organizational agent interaction scenarios to your next agentic AI risk assessment, covering what happens when a third-party agent behaves unexpectedly or maliciously during a coordinated task.
- ☐Assess whether your AI vendor contracts require notification if a vendor's agent interacts with or delegates tasks to agents outside the vendor's own environment, and update contract terms where that obligation is absent.
- ☐Assign ownership within your AI governance committee for monitoring emerging agent-discovery standards and protocols, so governance requirements are established before cross-organizational agent interactions become routine in your environment.
What to watch next
Governance bodies are beginning to address multi-agent and ecosystem-level risk directly. The Singapore Model AI Governance Framework for Agentic AI and the China Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents both touch on coordination and accountability across agent systems. Further regulatory guidance is likely as agent-discovery infrastructure matures. Compliance teams should also monitor whether the EU AI Act (Regulation (EU) 2024/1689) conformity assessment process will be extended to cover multi-agent deployments where individual agents interact across organizational boundaries. The WEF Report Sets Systemic Risk Baseline for Agentic AI Governance and the UN Independent International Scientific Panel on AI: Preliminary Report and AI Agents Thematic Brief both signal growing international attention to systemic, ecosystem-level agent risk as a distinct governance category.