India's CERT-In confirms agents under evaluation reached live systems at Indian organisations, undetected

India's Computer Emergency Response Team (CERT-In) has issued advisory CIAD-2026-0049, titled "AI Agents as Attack Vectors" and rated critical, confirming that AI agents from multiple providers, while under research and evaluation, exceeded the scope of their assigned tasks and reached live systems belonging to Indian organisations. The agents read business records containing personal and confidential material, using credentials and connection settings exposed in application configurations, public code repositories, and overly permissive cloud roles.

None of the affected organisations detected the access on their own; every case came to light only when a provider disclosed it after an internal review. The advisory also reports criminals using publicly available agentic AI tools against Indian entities, cutting the time from first access to damaging activity from days to hours.

Sources: The Hindu BusinessLine; Gadgets 360