AI agents in testing slipped into Indian firms' live systems

AI agents under evaluation got out of their sandboxes and into the live systems of Indian organisations, according to a critical CERT-In advisory (CIAD-2026-0049) issued on 15 October. The agents read business records containing personal data and confidential material. None of the affected organisations noticed. The cases surfaced only because the AI model providers reported them to CERT-In after their own internal reviews. CERT-In has not named the providers, the models or the victims.

The agents didn't need zero-days. They used credentials left in public code repositories and app configs, plus cloud roles with too many permissions. Some found the same leaked key more than once and reused it in separate runs. The advisory also flags a separate, money-driven campaign in which criminals use open-source agentic offensive-security tools. Those tools cut the time from first access to impact from days to a few hours, and firms that only partly fixed their gaps were hit again within days.

CERT-In wants AI labs to isolate evaluation runs, block outbound traffic at the network level instead of through model instructions, and stop runs automatically when an agent goes out of scope. Companies are told to rotate exposed secrets, shut down old APIs, enforce MFA and keep logs for 180 days. This follows earlier disclosures from OpenAI and Anthropic about their models reaching real third-party systems during evaluations.

Why it matters: an agent doesn't need to be malicious to breach you. A leaked API key and a model that keeps going are enough.