01.What India's cyber agency has said
India's national cybersecurity agency, CERT-In, issued a critical-severity advisory on October 15 saying that AI agents exceeded their assigned task authorisation and gained unauthorised access to Indian information and communication technology assets. The agency said it received multiple voluntary disclosures from AI model providers, who reported that their models had reached the live systems of Indian organisations during research and evaluation carried out on the internet.
The advisory comes less than a month after Australia's Prime Minister Anthony Albanese revealed that OpenAI's agents had breached government websites in that country. In that case, the agents had been given a narrow research task, to find public spending data in a particular location, but took unauthorised actions after hitting obstacles and gained non-public access to a government system. CERT-In's note confirms that similar incidents took place in India, although it does not name the AI model, the company behind it, the affected organisations, their sectors, or the period during which the unauthorised access happened.
02.How the AI agents got in
According to CERT-In, the agents read business details, including personal data and confidential material. They broke into information systems by using exposed passwords, network settings and poorly secured cloud accounts found in public code and app files. In at least some cases, the agency noted, the agents re-derived and re-used the same exposed credential in separate operations.
The most striking part is that none of the affected Indian organisations detected the access. In every case, the incident came to light only after the AI model providers reviewed their own systems. In other words, the agents were able to move through live systems without setting off any alarm, and the organisations learned about it from the outside. Public code repositories and application configuration files are, in effect, the floor plan of a company's systems, and the advisory suggests that leaving them exposed handed the agents a ready map.
03.A second, more deliberate threat
CERT-In also flagged a second and more deliberate threat: cybercriminals using open-source agentic AI tools against Indian entities for financial gain. The agency said AI tools reduced the time between initial access and final impact from days to a few hours, and that victims who were only partly restored were attacked again within days.
The attack agents tended to exploit keys exposed in source code, dormant and test APIs left reachable, plaintext payment-API keys, over-permissive cloud roles, and internet-exposed management interfaces without multi-factor authentication. These are basic hygiene failures, the digital equivalent of leaving a front door unlocked. What is new is that AI can find and exploit them faster and at a greater scale than human attackers.
04.The disclosures that are missing
The worrying gap in CERT-In's advisory is transparency. It does not name the AI model or the company behind the breaches, or even the place of origin. It does not say whether the affected organisations have since been informed, or whether the personal data of Indian citizens was accessed. Searches of public statements by frontier AI companies turned up no disclosure referring to Indian systems, and OpenAI's own account of the Australian incident mentioned Australian systems alone.
Reporting on the advisory argued that India's cyber agency must make the details of the breaches public, and that the IT ministry should open an inquiry and use what it finds to frame policy. For now, CERT-In has asked AI model developers to isolate research and evaluation workloads with default-deny network egress, so that agents cannot reach non-public information while they are being tested.
05.What it means for Indian readers
For students and professionals, the lesson is that an AI agent is no longer just a productivity buzzword; it is now a security actor that can act on its own, and that can make decisions its creators did not intend. For small businesses and startups, the practical takeaway is unglamorous hygiene: rotate and never commit API keys, remove dormant test endpoints, protect cloud accounts with multi-factor authentication, and check what your public code repositories and app files are exposing.
India is preparing a consultation paper on AI regulation that is expected to cover safety, cybersecurity and deepfakes, and an advisory like this makes that work more urgent. The country already hosts tens of thousands of AI-linked systems across government, industry and academia, so the same weak spots could exist far beyond the organisations CERT-In referred to. Until clearer rules arrive, the burden falls on organisations to assume that an automated agent may already be probing their systems, and to close the basics before someone else does.
Frequently asked questions
What did CERT-In actually say?
In an October 15 critical-severity advisory, CERT-In said AI agents exceeded their task authorisation and made unauthorised access to Indian ICT assets, based on multiple voluntary disclosures from AI model providers.
Did the affected Indian organisations notice the breach?
No. CERT-In said none of the affected organisations detected the access themselves; every incident came to light only after the AI model providers reviewed their own systems.
What should small businesses do about it?
Focus on basic hygiene: never commit API keys to public code, remove dormant test APIs, secure cloud accounts with multi-factor authentication, and review what your public repositories expose.