AI Developers' Tests Reached Indian Firms' Live Systems

AI agents tested by model providers accessed live systems belonging to Indian organisations, exposing confidential data without the organisations detecting it, according to disclosures received by India's cybersecurity agency. The Indian Computer Emergency Response Team (CERT-In) described the incidents in an advisory issued on October 15. The access came through exposed passwords, access keys left in public code repositories, and cloud accounts with broader permissions than necessary.

Access Beyond the Test

AI developers identified the incidents during reviews. The disclosures didn't establish that AI companies deliberately targeted Indian businesses, but they raised questions about whether developers sufficiently separated testing from real business systems. They also didn't establish how widespread the incidents were or whether accessed data went elsewhere.

AI agents can carry out tasks with limited human involvement, including searching the internet, using other software, and making decisions. During testing, an agent with internet access may encounter a working password or access key and enter a system unrelated to the test. For example, a key left in a public code repository could let an agent access a database.

Jaydeep Singh, general manager for India at cybersecurity firm Kaspersky, said: “It needs a goal and valid access.” He said task instructions may not stop an agent from reaching other systems if its credentials permit it. Rajesh Chhabra, general manager for India and Asia at cybersecurity firm Acronis, said an agent may find credentials in a configuration file, code repository, or cloud account that give it more access than its task requires. “The lesson isn't that the agent went rogue. It is that the permissions were weaker than anyone realised,” he said.

A company doesn't need to use its own AI agent for one to access its systems. If an agent finds a valid access key, it may enter through channels employees and other software also use. Security logs may show which account accessed a database without identifying whether a person, software program, or AI agent used it. “Logs record the credential used, not whether a human, a script or an agent used it,” Singh said. Businesses may also lack detailed records showing which files or customer records someone accessed after login.

Security Gaps and State Guidance

Sunil Sharma, managing director and vice-president of sales for India and SAARC at cybersecurity firm Sophos, said agents could operate at machine speed with valid credentials and broad permissions. “A legitimate agent can also become risky if it is compromised or misconfigured, so monitoring has to look at behaviour,” Sharma said. “The principle is simple: trust the agent's behaviour, not just its origin.”

Sophos' Active Adversary Report 2026 drew on 661 incident response and managed detection cases handled between November 2024 and October 2025. It found that 67 per cent of investigated incidents involved identity-related attacks. Multi-factor authentication was missing in 59 per cent of cases, and gaps in security-log retention had doubled year on year. The report's findings weren't directly related to the CERT-In disclosures, but pointed to broader access-management and monitoring problems.

CERT-In recommended that AI developers restrict agents' internet access during testing, use fake credentials and test data instead of real business information, and monitor agent activity. Developers should block testing systems from reaching unrelated live systems. The agency also recommended that businesses remove exposed keys, review system access, and disable online services they no longer need. Chhabra said companies should test agents in a separate copy of their systems, using fake records and dummy credentials rather than live business data.

The advisory doesn't answer who must notify an affected business and help investigate when an AI company discovers its model accessed another organisation's data without permission. Manish Chasta, co-founder and chief technology officer of Eventus Security, said businesses investigating suspected access should examine login, database activity, software request, and cloud access records to determine which account was used and what information it accessed. If a key is known to have been exposed or there's credible evidence it was misused, teams should revoke or replace it promptly; security teams should also check whether anyone created other accounts or keys and preserve relevant records.

Separate AI-Assisted Attacks

CERT-In also described separate incidents in which cybercriminals used AI tools to attack Indian organisations. The agency said those attacks cut the time between initial access and damage from days to hours. It observed that some organisations that hadn't fully addressed an earlier breach faced another attack on a larger scale. The advisory distinguished those attacks from cases in which agents under evaluation accessed systems beyond their authorised scope.

Kaspersky said its security products detected more than 92,000 attacks worldwide involving malware and potentially unwanted applications disguised as popular AI agents and services between January and early May 2026. It also identified more than 15,000 malware samples posing as agentic AI software, including fake versions of OpenClaw. Those figures concern malicious software disguised as AI tools, not the incidents disclosed by CERT-In.