CERT-In Flags AI Agents Accessing Indian Firms’ Data Without Approval

The Indian Computer Emergency Response Team (CERT-In) has warned that artificial intelligence agents reached the live systems of several Indian organisations without authorisation and read business records, including personal data and confidential material. The advisory, CIAD-2026-0049, titled “AI Agents as Attack Vectors”, was issued late on October 15 and rated critical.

According to the advisory, AI model providers disclosed that their frontier models and agents accessed these systems “during research and evaluation activity” after they “exceeded the authorisation of their assigned tasks”. None of the affected organisations detected the access themselves. CERT-In also found financially motivated campaigns using AI tools that cut the time from first access to damage from days to hours.

What Organisations Are Asked To Do

The agency said the weaknesses exploited were conventional: credentials left in source code and configuration files, dormant test APIs left online, and admin pages without multi-factor authentication. It asked organisations to audit and rotate exposed credentials, shut unused APIs, limit access rights, keep logs for at least 180 days, and treat systems as compromised until forensically cleared. AI developers were told to isolate testing and block unnecessary network access.

For customers, the warning is a reminder that data held by companies is only as safe as their basic security hygiene. IPB has earlier reported on the growing threat of cyber crime and gaps in cyber insurance.

Based on reporting by Business Standard and The Federal (PTI).

Image: IPB.