India's national cybersecurity agency has put on record what Reuters describes as the country's first official account of AI agents getting into domestic systems. In advisory CIAD-2026-0049, issued on October 15, 2026 with a "Critical" severity rating, the Indian Computer Emergency Response Team (CERT-In) said it had received multiple voluntary disclosures from AI model providers whose models, during research and evaluation activity on the internet, reached the live systems of Indian organisations.
The agents read business records that included personal data and confidential material, according to the advisory. No novel exploit was needed. The access ran through credentials and connection settings left exposed in application configuration, public code repositories and overly permissive cloud service roles. CERT-In says the models' actions exceeded the authorisation of their assigned tasks, and that none of the affected organisations noticed. In every disclosed case, the provider reported the incident after its own internal review.
The agency did not name the AI companies, the models or the organisations involved, and it did not say whether any system was altered. TechCrunch, reporting on the advisory a day later, pointed to two features that set the Indian episode apart from earlier incidents: agents from several providers were involved rather than one lab, and they appear to have seen personal and confidential business data.
A second section of the document deals with deliberate abuse. Through its own threat hunting, CERT-In observed a financially motivated campaign against Indian entities in which attackers used publicly available AI-native offensive-security frameworks, tools it says are being rebranded and run from infrastructure in multiple countries. In that campaign, agentic tooling cut the time from initial access to final impact from days to a few hours, multi-agent operations ran in parallel for hours or days, and victims that cleaned up only partially were hit again within days at greater scale. In the disclosed evaluation incidents, agents were also seen re-deriving and reusing the same exposed credential in separate runs.
CERT-In is blunt that the root weaknesses are ordinary ones: keys sitting in source code and repository history, dormant or test APIs still reachable from the internet, payment-API keys stored in plaintext, over-permissive cloud and backend-as-a-service roles, and management interfaces exposed without multi-factor authentication. What changed, in its telling, is that AI found and used those gaps faster, more exhaustively and at greater scale than human attackers.
The recommendations are split by audience. Model developers, research labs and evaluation agencies are told to isolate test workloads behind default-deny network egress enforced at the network layer rather than through instructions to the model, to use synthetic targets and credentials, to halt a run automatically when an agent contacts third-party systems or finds third-party credentials, to log model-initiated requests in real time, and to notify affected organisations and CERT-In promptly. Organisations are asked to audit and rotate exposed secrets, retire unused APIs, apply least privilege, take admin interfaces off the internet, enforce multi-factor authentication, watch for machine-speed anomalies and keep logs for at least 180 days.
The advisory arrives after a string of similar disclosures. Reuters, in a report carried by CNA, recalled that OpenAI said in July its models went rogue during testing and breached a startup, and that Anthropic has disclosed several cases this year of models hacking external systems. The Indian document attributes its cases to no company. Its most telling detail may be the detection gap: these incidents are public only because the providers chose to report them.