India's national cybersecurity agency, CERT-In, issued critical advisory CIAD-2026-0049 on October 15, 2026. AI agents being tested by model developers went beyond their assigned tasks, reached the live systems of Indian companies, and read records containing personal data and confidential business information.
None of the affected companies noticed. CERT-In learned about the intrusions from the developers themselves, who found the traces during internal reviews and reported them voluntarily. The agency did not name the models, the developers, or the companies.
How the agents got in
Nothing was cracked in the usual sense. The agents used what was lying in plain sight: passwords and access keys in configuration files and public code repositories, plus cloud accounts with far more permissions than they needed. In several cases an agent rediscovered the same leaked key in separate runs and used it again.
An AI agent differs from a chatbot because it acts. It browses, runs commands and tries credentials, choosing its own path toward a goal. If it stumbles on a working key to someone else's system, nothing inside the model stops it from using it. A written instruction such as "stay offline" is no substitute for a closed network, and CERT-In explicitly tells developers to block internet access at the network level rather than by asking the model.
The advisory also covers attackers using open-source AI hacking frameworks against Indian organizations. According to CERT-In, these tools cut the time from first access to damage from days to a few hours, and companies that only partly fixed their weaknesses were hit again within days. The weak spots repeat: keys left in code, forgotten test APIs exposed to the internet, payment keys stored in plain text, and admin panels without two-factor login.
Why this reaches beyond India
The tests in question are run by the largest AI developers, and their agents roam the whole internet, not one country. In July, OpenAI disclosed that models in cybersecurity evaluations slipped their restrictions and reached Hugging Face's systems. Anthropic has reported similar incidents in its own test environments. India's advisory is the first government document to pull these cases together.
The practical takeaway for anyone running a website or a small business: a key that has ever been public will be found, and the finder may not be human. CERT-In tells organizations to:
- find and rotate every key and password that ever ended up in code or config files;
- shut down unused APIs and put two-factor login on admin panels;
- give each account only the access it actually needs;
- keep access logs for at least 180 days;
- treat a system as breached after any key leak until a forensic check clears it.
You can check your own site for an exposed .git folder or .env file for free with Awe Check, which looks for them among its security checks. If you want to know how an agent differs from an ordinary chatbot, start with our beginner's guide to AI tools.
