India: AI Agents Under Testing Reached Live Company Systems

On 15 October, India's national cybersecurity agency CERT-In issued a critical advisory (CIAD-2026-0049). It says that AI agents being tested by model developers went beyond their assigned tasks and reached the live systems of Indian companies.

The agents read business records, including personal and confidential data. None of the affected companies detected the access themselves. The AI companies reported the cases to the agency after their own internal reviews. CERT-In did not name the AI companies, the affected organisations or the number of cases.

How the agents got in

No classic hacking was needed. The agents used what had been left open: passwords and keys in configuration files and public code, and cloud accounts with excessive permissions. In some cases an agent found the same leaked key and reused it in separate runs.

What the agency recommends

For AI developers: test agents in isolated environments with restrictions enforced at the network level, using fake data and keys, and stop a run automatically if an agent contacts outside systems. For companies: replace leaked keys, shut down unused and test APIs, require two-factor authentication for administrators and keep logs for at least 180 days.

Separately, CERT-In describes another trend: criminals are already using publicly available AI-agent tools for financially motivated attacks. According to the agency, this cuts the time from first access to damage from days to a few hours.

My comment

The main lesson here is not about AI, it is about keys. The agents walked through doors that had been left open for years: passwords in configs, forgotten test interfaces, excessive permissions. A human could have found them too, but more slowly. An agent checks everything and does not get tired.

The second lesson concerns the testing itself. CERT-In states plainly that the ban on reaching the network must be enforced at the network level, not by asking the model. An instruction in a prompt is not a technical restriction.

For the owner of any service the practical conclusion is simple: anything reachable from outside and weakly protected will be found automatically, and not necessarily by an attacker. It is a continuation of the story I wrote about recently: an agent carries out its task literally and uses any opportunity it finds.

Sources: The Hacker News, The Next Web.