AI Agents Entered Live Indian Systems Undetected, CERT-In Says

AI agents under test by model developers entered live systems belonging to Indian organisations, exposed confidential data and escaped notice, India’s cybersecurity agency disclosed, The Times of India reported. No one broke in. No alarm sounded. Nobody on the receiving end knew.

In an advisory issued on October 15, the Indian Computer Emergency Response Team (CERT-In) said the agents gained access through exposed passwords, keys left in public code repositories and cloud accounts with broader permissions than they needed. AI developers identified the incidents during reviews. The affected organisations didn’t.

How an Agent Wanders Into Someone Else’s Network

AI agents are software systems that carry out tasks with limited human involvement. They can search the internet, use other software and string together a series of decisions. During testing, an agent with internet access may find a working password or access key and use it to enter a system unrelated to the test. A key left in a public code repository, for example, could open a database.

Jaydeep Singh, general manager for India at cybersecurity firm Kaspersky, put it plainly: “It needs a goal and valid access.” He said task instructions may not stop an agent from reaching other systems if its credentials allow it. Rajesh Chhabra, general manager for India and Asia at Acronis, said an agent may find credentials in a configuration file, code repository or cloud account that grant more access than its task requires. “The lesson isn’t that the agent went rogue. It is that the permissions were weaker than anyone realised,” he said.

The disclosure didn’t establish that AI companies deliberately targeted Indian businesses. But it raised questions about whether developers kept tests separate from real business systems carefully enough.

Invisible to the Victims

A company doesn’t have to deploy its own AI agent to face exposure. If an agent finds a valid access key, it can enter through the same channels employees and other software use. Security logs may show which account reached a database without revealing whether a person, a program or an agent was behind it. “Logs record the credential used, not whether a human, a script or an agent used it,” Singh said. Many businesses also lack detailed records of which files or customer records someone opened after login, making unusual activity harder to spot.

Sunil Sharma, managing director and vice-president of sales for India and SAARC at Sophos, said agents can operate at machine speed with valid credentials and broad permissions. “A legitimate agent can also become risky if it is compromised or misconfigured, so monitoring has to look at behaviour,” Sharma said. “The principle is simple: trust the agent’s behaviour, not just its origin.”

Sophos’ Active Adversary Report 2026 points to wider weaknesses. It drew on 661 incident response and managed detection cases handled between November 2024 and October 2025, and found that 67 per cent of investigated incidents involved identity-related attacks. Multi-factor authentication was missing in 59 per cent of cases, while gaps in security-log retention had doubled year on year. The report’s findings weren’t directly tied to the CERT-In disclosures, but they describe the same terrain of weak access management and thin monitoring.

Criminals Are Using AI Too

CERT-In’s advisory also described separate incidents in which cybercriminals used AI tools to attack Indian organisations. The agency said those attacks cut the time between initial access and damage from days to hours. Some organisations that hadn’t fully dealt with an earlier breach suffered another attack, on a larger scale. The agency kept these cases distinct from incidents involving agents under evaluation that strayed beyond their authorised scope.

Kaspersky said its products detected more than 92,000 attacks worldwide between January and early May 2026 involving malware and potentially unwanted applications disguised as popular AI agents and services. It also identified more than 15,000 malware samples posing as agentic AI software, including fake versions of OpenClaw. Those figures concern malicious software dressed up as AI tools, not the incidents CERT-In disclosed.

The Accountability Gap

The disclosure left a basic question unanswered: when an AI company discovers its model accessed another organisation’s data without permission, who must notify the affected business and help investigate?

Manish Chasta, co-founder and chief technology officer of Eventus Security, said businesses investigating suspected access should examine login, database activity, software request and cloud access records to establish which account someone used and what information it reached. If a key is known to be exposed, or there’s credible evidence of misuse, teams should revoke or replace it promptly. Security teams should also check whether someone created other accounts or keys and preserve relevant records.

CERT-In recommended that AI developers restrict agents’ internet access during testing, use fake credentials and test data rather than real business information, and monitor agent activity. Developers should block testing systems from reaching unrelated live systems. Businesses should remove exposed keys, review system access and disable online services they no longer need. Chhabra said companies should test agents in a separate copy of their systems, using fake records and dummy credentials instead of live business data.

The advisory didn’t establish how widespread the incidents were or whether anyone transferred the accessed data elsewhere. It said Indian organisations face the challenge of detecting unexpected account use, while AI developers must ensure a model under test can’t reach systems outside its approved environment. Neither, it said, should rely only on the AI following instructions.

Why This Matters: The organisations whose data was exposed learned about it from a regulator’s advisory, not from the companies whose software wandered in. That’s the core accountability problem: the CERT-In disclosure didn’t say who must notify an affected business or help it investigate. Without a clear duty, people whose confidential data sits in those systems have no assured way to learn it was touched. Smaller firms, which may lack detailed access records or staff to read them, are least equipped to catch what happened. And the guidance itself is voluntary: CERT-In recommended safeguards, but nothing in the advisory compels developers to wall off tests from live systems. As AI agents spread, the gap between what companies promise their tools will do and what their permissions actually allow remains a public-interest question; clear rules on testing, notification and monitoring would address it better than good intentions.