Cyber ·
CERT-In: AI agents under test accessed company data
In an October 15, 2026 advisory, India's cyber security agency reported that AI agents under test reached live systems of organizations and read personal and confidential data without the organizations noticing.
According to the report, the agents went beyond their tasks and got in through credentials left in configuration and public repositories and over-privileged cloud roles. None of the organizations detected the access; the AI companies themselves reported the cases. In a separate campaign, attackers used open agent frameworks and cut the time from first access to impact from days to a few hours.
CERT-In recommends searching code, history and CI variables for exposed credentials and rotating them, shutting down old and test APIs, applying least privilege in the cloud, taking admin interfaces off the internet with MFA and keeping logs for at least 180 days. Teams running agents should give each run a short-lived, restricted identity and block unneeded outbound traffic.