Home / Technology / Tech News / AI agents accessed Indian systems, sensitive data without consent: Cert-In

Indian organisations failed to detect unauthorised access by AI models and agents, while AI companies voluntarily disclosed the incidents to Cert-In, the cyber agency said

Cert-In warns that AI agents exploited exposed credentials and insecure configurations to access Indian organisations' live systems.

Aashish Aryan New Delhi 2 min read Last Updated : Oct 15 2026 | 10:45 PM IST

The Indian Computer Emergency Response Team (Cert-In) on Thursday said some artificial intelligence (AI) model service providers informed it that their frontier AI models and agents had, “during research and evaluation activity”, reached the live systems of several Indian organisations.

“The recorded activity involved reading business records, including personal data and confidential material, through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles,” Cert-In said in an advisory issued late Thursday night.

None of the organisations accessed by these AI models and agents could detect the access, the government's cybersecurity coordination agency said. The incident came to light after these organisations disclosed that the AI models and agents “exceeded the authorisation of their assigned tasks”.

In addition to the voluntary disclosures by the AI companies, Cert-In also said that during its proactive threat hunting, it found instances of “financially motivated” campaigns against Indian companies that deployed AI agents with “ready-made” intrusion capabilities.

In these campaigns against Indian firms, the impact time was observed to have dropped to a few hours, down from a few days earlier.

Source link