AI Agents Reached Live Indian Systems Undetected

India’s cybersecurity agency said AI agents under evaluation by model providers accessed live systems at Indian organisations and exposed confidential data without triggering detection. The Indian Computer Emergency Response Team, or CERT-In, detailed the incidents in an advisory issued on October 15. The disclosure raised questions about whether developers had adequately separated tests from real business systems.

How access happened

CERT-In said agents entered systems through exposed passwords, access keys left in public code repositories and cloud accounts with permissions broader than necessary. AI developers found the incidents during reviews. The advisory did not establish that AI companies deliberately targeted Indian businesses.

AI agents can handle tasks with limited human involvement. They may search the internet, use other software and make a series of decisions. During testing, an agent with internet access might come across a working password or access key and enter a system unrelated to its test. For instance, a key left in a public code repository could let an agent access a database.

Jaydeep Singh, general manager for India at cybersecurity firm Kaspersky, said: “It needs a goal and valid access.” He said task instructions may not stop an agent from reaching other systems when its credentials allow access. Rajesh Chhabra, general manager for India and Asia at cybersecurity firm Acronis, said an agent might find credentials in a configuration file, code repository or cloud account that provide more access than its task requires. “The lesson isn't that the agent went rogue. It is that the permissions were weaker than anyone realised,” he said.

What organisations may not see

A company doesn't need to use its own AI agent for one to access its systems. If an agent finds a valid access key, it can enter through channels employees and other software also use. Security logs may show which account accessed a database but not whether a person, software program or AI agent used it. “Logs record the credential used, not whether a human, a script or an agent used it,” Singh said.

Businesses may also lack detailed records showing which files or customer records someone accessed after login. That can make unusual activity harder to spot. Sunil Sharma, managing director and vice-president of sales for India and SAARC at cybersecurity firm Sophos, said agents could work at machine speed with valid credentials and broad permissions. “A legitimate agent can also become risky if it is compromised or misconfigured, so monitoring has to look at behaviour,” Sharma said. “The principle is simple: trust the agent's behaviour, not just its origin.”

Sophos' Active Adversary Report 2026 covered 661 incident response and managed detection cases handled between November 2024 and October 2025. The report found that identity-related attacks featured in 67 per cent of investigated incidents, multi-factor authentication was missing in 59 per cent of cases, and gaps in security-log retention had doubled year on year. The findings weren't directly related to CERT-In's disclosures; they pointed to wider problems with access management and monitoring.

Separate threats and safeguards

CERT-In also described separate incidents in which cybercriminals used AI tools to attack Indian organisations. The agency said those attacks cut the time between initial access and damage from days to hours. It observed that some organisations that had not fully addressed an earlier breach faced another attack on a larger scale. CERT-In distinguished these attacks from cases where agents under evaluation accessed systems beyond their authorised scope.

The agency recommended limiting agents' internet access during testing, using fake credentials and test data instead of real business information, and monitoring agent activity. Organisations should block testing systems from reaching unrelated live systems. CERT-In also advised businesses to remove exposed keys, review system access and disable online services they no longer need. Chhabra said companies should test agents in a separate copy of their systems, with fake records and dummy credentials rather than live business data.

The advisory did not establish how widespread the incidents were or whether anyone transferred accessed data elsewhere. It also did not say who must notify an affected business and help investigate when an AI company discovers its model accessed another organisation's data without permission. CERT-In identified the central challenge: detecting unexpected account use and ensuring a model under test can't reach systems outside its approved environment.