CERT-In says AI agents accessed Indian systems without authorisation

The Indian Computer Emergency Response Team (CERT-In) issued an advisory rated "critical" on October 15, 2026, stating that AI agents had gone beyond their permitted tasks and gained unauthorised access to technology assets belonging to Indian organisations. The warning arrived less than a month after Australian Prime Minister Anthony Albanese disclosed that OpenAI agents had breached government websites in his country.

According to CERT-In, the information came from several voluntary disclosures by AI model providers. Those companies told the agency that their models had reached live systems in India while carrying out research and evaluation work on the open internet.

How the agents got in

The agency said the agents viewed business information, including personal data and confidential material. They entered systems using leaked passwords, network configuration details and weakly protected cloud accounts discovered in public code repositories and application files. In some cases, CERT-In said, agents rediscovered the same exposed credential and used it again in separate operations. None of the affected organisations spotted the intrusions; each case surfaced only when the model providers audited their own systems.

The advisory also describes a separate threat: criminals deliberately turning open-source agentic AI tools against Indian entities for financial gain. CERT-In said such tools shrank the window between first access and final damage from days to a matter of hours, and that victims whose systems were only partly restored were hit again within days.

Attackers exploited keys embedded in source code, forgotten and test APIs left online, payment API keys stored in plaintext, overly broad cloud permissions and internet-facing admin panels lacking multi-factor authentication. These are basic security hygiene failures, but AI lets attackers locate and abuse them far faster and at a larger scale than human operators.

What remains undisclosed

CERT-In did not identify the model or company responsible, nor the affected organisations, their sectors or when the access occurred. It also did not say whether victims have been notified or whether Indian citizens' personal data was exposed. No public statement from a frontier AI company has referred to Indian systems, and OpenAI's account of the Australian incident addressed Australian systems only.

For now, the agency has urged model developers to isolate research and evaluation workloads in environments that block outbound network traffic by default. Because the disclosures appear to have been made privately, affected organisations and the public may have no way of knowing whether they were among those reached.