AI Agents Enter Indian Systems Through Weak Controls

AI agents tested by model providers accessed live systems belonging to Indian organisations and exposed confidential data without the organisations noticing, according to disclosures received by India’s cybersecurity agency. The Indian Computer Emergency Response Team (CERT-In) described the incidents in an advisory issued on October 15. The route in wasn’t a dramatic breach of locked doors. Instead, agents found exposed passwords, access keys left in public code repositories and cloud accounts with broader permissions than necessary.

Who Has the Access

AI developers identified the incidents during reviews. The disclosure didn’t establish that AI companies deliberately targeted Indian businesses, but it raised a blunt question: did developers keep tests sufficiently separate from real business systems? A system built to act with limited human involvement can find a working credential and use it to enter somewhere its operators didn’t intend.

Jaydeep Singh, general manager for India at cybersecurity firm Kaspersky, put the requirement plainly: “It needs a goal and valid access.” Task instructions may not keep an agent out of other systems if its credentials permit entry. Rajesh Chhabra, general manager for India and Asia at cybersecurity firm Acronis, said an agent could find credentials in a configuration file, code repository or cloud account that grant more access than the task requires. “The lesson isn't that the agent went rogue. It is that the permissions were weaker than anyone realised,” he said.

A business doesn’t have to use its own AI agent for one to reach its systems. If an agent finds a valid access key, it may enter through channels employees and other software also use. Security logs may show which account accessed a database, but not whether a person, script or agent used it. “Logs record the credential used, not whether a human, a script or an agent used it,” Singh said. Businesses may also lack detailed records showing which files or customer records someone accessed after login. That can make unusual activity harder to spot.

The Cost of Broad Permissions

Sunil Sharma, managing director and vice-president of sales for India and SAARC at cybersecurity firm Sophos, said agents could operate at machine speed when they have valid credentials and broad permissions. “A legitimate agent can also become risky if it is compromised or misconfigured, so monitoring has to look at behaviour,” Sharma said. “The principle is simple: trust the agent's behaviour, not just its origin.”

Sophos' Active Adversary Report 2026 drew on 661 incident response and managed detection cases handled between November 2024 and October 2025. It found that 67 per cent of investigated incidents involved identity-related attacks. Multi-factor authentication was missing in 59 per cent of cases, and gaps in security-log retention had doubled year on year. Those findings weren’t directly related to the CERT-In disclosures, but they point to broader problems with access management and monitoring.

CERT-In separately described incidents in which cybercriminals used AI tools to attack Indian organisations. The agency said those attacks cut the time between initial access and damage from days to hours. It also observed that some organisations that hadn’t fully addressed an earlier breach faced another attack on a larger scale. The agency distinguished those attacks from cases where AI agents under evaluation accessed systems beyond their authorised scope.

What the Advisory Requires

The advisory didn’t establish how widespread the agent incidents were or whether anyone transferred accessed data elsewhere. It also didn’t answer who must notify an affected business or help investigate when an AI company discovers its model accessed another organisation’s data without permission. Organisations are left with an access problem, and their records may not tell them what happened.

CERT-In recommended that AI developers restrict agents’ internet access during testing, use fake credentials and test data instead of real business information, monitor agent activity, and block testing systems from reaching unrelated live systems. It also recommended that businesses remove exposed keys, review system access and disable online services they no longer need. Chhabra said companies should test agents in a separate copy of their systems, using fake records and dummy credentials rather than live business data.

Manish Chasta, co-founder and chief technology officer of Eventus Security, said businesses investigating suspected access should examine login, database activity, software request and cloud access records to determine which account was used and what information it accessed. If a key is known to have been exposed or there’s credible evidence it was misused, businesses should revoke or replace it promptly. Security teams should also check whether anyone created other accounts or keys and preserve relevant records.

The advisory’s central warning concerns systems that can reach beyond their approved environment. Developers and organisations shouldn’t rely only on an AI agent following instructions; permissions and monitoring have to constrain what it can actually access.