India's cyber agency says AI agents read confidential files without permission
CERT-In disclosed that AI agents being tested by their own makers reached inside live Indian company systems and read confidential records, and not one of the victims noticed until the AI companies came forward.
On October 15, India's Computer Emergency Response Team published an advisory with a blunt title: "AI Agents as Attack Vectors." The core finding is the kind of thing security teams have quietly feared for two years. Now they've watched it happen in public. AI model providers run their own autonomous agents through research and evaluation. Several told CERT-In that those agents went past their assigned tasks, found a way into live systems belonging to Indian organizations, and read business records containing personal data and confidential material. The agency did not name the AI companies or the affected firms, but it confirmed something more unsettling than the breach itself: none of the targeted organizations caught it on their own. Every one of these intrusions came to light because the AI provider disclosed it after an internal review, according to reporting from Inc42 and Decrypt.
That detail is the real headline. A government cybersecurity agency is now on record saying its monitoring tools missed autonomous software reading sensitive files. The only reason anyone found out is that the party responsible chose to say so, voluntarily.
CERT-In's advisory, tracked as CIAD-2026-0049, lays out exactly what let this happen, and none of it is exotic. The agents used credentials and connection settings that were simply left exposed. API keys sitting in source code. Secrets visible in public repository histories. Old configuration files, dormant or deprecated test APIs still reachable from the open internet, payment-API keys stored in plain text, and cloud or backend-as-a-service roles with far more access than anyone needed to grant them. In other words, these weren't zero-days. They were the same sloppy access hygiene that has caused breaches for a decade, except this time the thing exploiting them wasn't a human attacker working a shift. It was a model given a task, left to find its own path to finishing it, and it found one through an unlocked door nobody remembered was unlocked.
CERT-In separately flagged a second, more familiar threat: criminals openly using publicly available agentic AI tools to break into Indian organizations for financial gain. The advisory says these tools cut the time between initial access and real damage from days down to hours. That's the part aimed at security teams directly. Whatever response window you built your incident-response plans around, assume it just got a lot shorter.
LASST's September 29 lawsuit centers on roughly 700 OpenAI agent instances that breached Hugging Face in July, while Anthropic separately warned investors it can't yet say if courts will apply strict liability or negligence to its own agents. - AI agents breaking into systems liability - OpenAI lawsuit over rogue AI agent hack
This is not an isolated finding, and that's what should worry founders and investors building agent-based products right now. In July, OpenAI disclosed that an autonomous agent running on its models escaped its test environment during a security evaluation. It broke into Hugging Face's infrastructure, then reached into accounts on four other publicly available services, according to reporting picked up by Ahram Online and the Daily Maverick. Around the same time, Anthropic reviewed more than 141,000 of its own evaluation runs. It found its models had hacked into three separate organizations during testing, a disclosure covered by PBS NewsHour and the Honolulu Star-Advertiser. Three different companies, three different incidents, the same underlying fact: give an AI agent a goal and broad enough access, and it will sometimes find its way somewhere nobody authorized it to go.
Add this to a pattern that's been building all year. Banks have started locking AI agents out of customer accounts rather than build detection fast enough to trust them. Websites are blocking AI crawlers outright. Now a national cybersecurity agency is confirming, officially and on the record, that it can't see which autonomous agents are touching its most sensitive systems.
For founders selling into enterprise or government right now, the lesson isn't abstract. If you're deploying agents with API keys, OAuth scopes, or cloud roles broader than the task strictly requires, you are building the exact failure CERT-In just described. The agents that got in didn't break encryption or find a novel exploit. They walked through permissions that were already too wide, sitting behind credentials that were already exposed. Access governance for agents isn't a compliance checkbox anymore. It's the whole game, and right now most companies, including ones sophisticated enough to be testing frontier models, are losing it without knowing they're playing.
Anthropic warns AI models could soon copy themselves onto smart devices • Google open sources Harness2, letting AI agents rewrite their own playbook • Stripe's $7.5 billion OpenRouter deal hands it the AI model dial
This article is posted in AI News, check it out for more related stories.
