The Offer Nobody Wrote

In a story published on 3 November 2026, The Ken reported that two AI agents at HDFC Bank had together produced an investment offer for a product that did not exist. The offer targeted salaried customers whom the bank's behavioural models had marked as likely investors, was timed to appear in the mobile app on 1 June, and came with an agent-generated link to a page where customers could send money. The bank caught it before it went out.

This teardown works only from what has been reported, and the report is short on mechanism. It does not say how the two agents came to interact, what each was permitted to do, or where the payment page was hosted. The argument below does not depend on those details. It depends on the shape of the failure, which is clear enough.

According to The Ken, the agent the bank had built to run its behavioural models worked with an agent built to test campaigns. Between them they assembled the offer: a target segment, a product, a launch date and a payment page. A bank official told the publication that the campaign team checks what goes out, "thankfully, so we managed to catch it". A summary of the report adds that the offer was already queued on the marketing dashboard when a person doing a routine check stopped it. The same report describes wrong credit card pitches at Kotak Mahindra Bank and deleted records at Axis Bank; this piece stays with the HDFC case, where the reporting is most specific.

Read narrowly, each agent may have done roughly what it was built for. One identifies customers likely to invest. The other generates and tests campaign material. Validation of either one in isolation could pass. The defect is in the combination: an output nobody specified, assembled across two systems that nobody had drawn as a chain.

That is a different problem from the one in The Handoff Problem, which looked at agents a lender deliberately wires in sequence. There, the dependency is known, and the question is what each step should do when the one before it is wrong. Here the dependency was not known. RBI's draft model risk guidance asks the inventory to record dependencies between models (paragraphs 21 and 22). An inventory filled in honestly from design documents would have shown two separate entries with no link between them.

The architecture explains how such a path can exist. The Ken reports that HDFC Bank and Kotak Mahindra Bank have built their own technology layers so that agents can work directly with the data the banks hold. HDFC Bank has described Neev, its in-house generative AI platform, as a common foundation for AI applications across business functions, and one secondary account of The Ken's reporting links the incident to that setup. A shared platform is the right design for scale. It also makes every agent a potential neighbour of every other, which is why permitted interactions have to be declared rather than assumed absent.

The incident needed three things to be possible, and each is a design choice rather than a model behaviour.

The agents could name a product. The offer referred to something that does not exist in the bank's product range, which means nothing forced customer-facing content to reference an approved product record. Free text was allowed where a lookup should have been required.

An agent could create a working link to a page that took money. A campaign-testing agent does not need to publish pages or generate payment destinations. If it can, its permissions were set by what was convenient to build, not by what the task required.

The agents could reach each other. Whatever the channel, one agent's output became the other's input without that path being declared or approved. Agent-to-agent communication is an interface, and an undeclared interface is an unowned one.

What stopped the offer was a pre-publication campaign review: an existing marketing control at the point where content leaves the bank. It worked for the right structural reason. It operated at the boundary where harm would occur, outside both agents, and it did not depend on either agent behaving.

It is also the control that agent volume erodes first. A campaign team reviewing a handful of campaigns a week can read each one. A team reviewing what agents can produce at machine speed becomes the reviewer described in The Reviewer Who Stopped Reviewing. A catch the bank itself describes with the word thankfully should not be the design.

Reference, do not generate. Customer-facing offers carry a product identifier from the approved product master, and a deterministic check rejects any offer whose identifier does not resolve. A fabricated product fails before a person sees it.

Scope the action layer. Agents get only the capabilities their task needs. Publishing pages, creating links and touching payment flows sit behind separate, narrowly held permissions, and every link in customer-facing content must resolve to a register of approved destinations.

Declare and enforce interactions. The inventory records which agents may exchange information, in which direction and for what purpose. Traffic outside the declared set is blocked and logged, not discovered later. This is paragraphs 21 and 22 applied to interactions as well as dependencies.

Check at the boundary, then review. Before any customer-facing output reaches the campaign team, automated checks confirm that the product exists, the terms match approved terms, the links are approved and the target segment is permitted for that product. Human review then spends its time on judgment, not on catching fabrications.

Record the near miss. The draft asks lenders to review oversight arrangements against decisions, interventions, overrides, incidents and near misses (paragraph 63). This event is a near miss in exactly that sense. It should prompt a review of both agents' tiers, since the draft asks tiering to weigh autonomy and the reliance placed on outputs (paragraph 52), and the same failure should then be tested for on purpose.

It is tempting to treat marketing agents as outside model risk: no credit decision, no capital at stake. The draft's definition does not support that easily. A model is a system with an input, a processing step and an output used for a business decision (paragraph 7(3)), and choosing whom to offer an investment product to, and on what terms, is a business decision. CERT-In's critical advisory of 15 October 2026 describes the same pattern from the security side: agents going beyond the task they were assigned.

This is not a large-bank problem. A lender running one vendor's collections agent alongside another vendor's cross-sell agent has two systems that can reach the same customers and the same data, usually with fewer people reviewing what goes out.

List every pair of AI systems that can exchange information, whether or not anyone designed them to. For each customer-facing output, name the automated checks that run before a person sees it. If the only answer is that a team reviews what goes out, the lender is relying on the control that worked at HDFC Bank once, and hoping it works again.