What if an AI agent being tested by a company on the other side of the world could quietly enter your business’s systems, read confidential records and leave without triggering an alarm?India’s cybersecurity agency has flagged precisely this kind of risk, reporting cases in which AI agents accessed live systems during research and testing, exposing a blind spot in how companies protect their data from tools they may never have authorised.In an advisory issued on October 15, the Indian Computer Emergency Response Team (CERT-In) said it had received voluntary disclosures from AI model providers whose agents had accessed live systems belonging to Indian organisations. The agents reportedly found their way in through exposed passwords, access keys left in public code repositories and cloud accounts with broader permissions than necessary.The affected organisations did not detect the access themselves, CERT-In said. The incidents came to light through reviews by the AI developers, raising a troubling question: if an AI agent can cross into a real business system while being tested elsewhere, how would the business know what it had seen, or whether its data had been exposed?
Five security gaps that can expose businesses to AI agents
How can an AI test reach a real business?
AI agents are software systems that can carry out tasks with limited human involvement. They can search the internet, use other software and make a series of decisions to complete a task.Developers test these agents to understand what they can do. But if an agent is allowed to access the internet and comes across a working password or access key, it may be able to enter a system that was never meant to be part of the test.For example, a company may accidentally leave an access key in a public code repository. If that key allows entry to a database, an AI agent that finds it may be able to read the information stored there.Jaydeep Singh, general manager for India at cybersecurity firm Kaspersky, said an agent does not need hostile intent to cause a breach.“It needs a goal and valid access,” he said.Singh said an agent may be given instructions to stay within a certain task, but those instructions cannot prevent access to other systems if its credentials allow it to go further.Rajesh Chhabra, general manager for India and Asia at cybersecurity firm Acronis, said an agent may find credentials in a configuration file, code repository or cloud account that give it more access than its task requires.“The lesson isn’t that the agent went rogue. It is that the permissions were weaker than anyone realised,” he said.The disclosure does not establish that AI companies deliberately targeted Indian businesses. It does, however, raise questions about whether developers did enough to keep their tests separate from real business systems.
AI went looking online and found its way into Indian firms’ confidential data
Why did the businesses not notice?
A company does not need to have an AI agent of its own for one to access its systems. If an agent finds a working access key, it may be able to enter through the same channels used by employees and other software.This can make the activity difficult to identify. Security systems may record that an account accessed a database, but not clearly show whether the account was being used by an employee, a software programme or an AI agent.“Logs record the credential used, not whether a human, a script or an agent used it,” Singh said.Some businesses also do not keep detailed records of which files or customer records were accessed after a successful login. Without these records, security teams may struggle to identify unusual activity.Sunil Sharma, managing director and vice-president of sales for India and SAARC at cybersecurity firm Sophos, said agents can operate at machine speed while using valid credentials and broad access permissions.“A legitimate agent can also become risky if it is compromised or misconfigured, so monitoring has to look at behaviour,” Sharma said. “The principle is simple: trust the agent’s behaviour, not just its origin.”Sophos’ Active Adversary Report 2026, based on 661 incident response and managed detection cases handled between November 2024 and October 2025, found that 67 per cent of the investigated incidents involved identity-related attacks. It also found that multi-factor authentication was missing in 59 per cent of cases and that gaps in the retention of security logs had doubled year on year.These findings do not relate directly to the incidents disclosed by CERT-In. They point to wider problems with how organisations manage access to their systems and track activity within them.
CERT-In flags a new cyber blind spot
AI agents also raise risks for cyberattacks
CERT-In’s advisory also described a separate set of incidents in which cybercriminals used AI tools to carry out attacks against Indian organisations.The agency said these attacks reduced the time between gaining initial access to a system and causing damage from days to hours. It also observed that some organisations that had not fully addressed an earlier breach were attacked again on a larger scale.The two situations are different. In the first, an AI agent under evaluation accessed systems beyond its authorised scope. In the second, criminals used AI tools to attack organisations. Both show how quickly weaknesses such as exposed passwords and excessive access permissions can be exploited.Kaspersky reported that its security products detected more than 92,000 attacks involving malware and potentially unwanted applications disguised as popular AI agents and services worldwide between January and early May 2026. It also identified more than 15,000 malware samples posing as agentic AI software, including fake versions of OpenClaw.These figures concern malicious software disguised as AI tools, not the incidents reported by CERT-In. Read Kaspersky’s findings.
Who is responsible if an AI agent accesses confidential data?
The CERT-In disclosure leaves an important question unanswered: when an AI company discovers that its model has accessed another organisation’s data without permission, who must notify the affected business and help investigate what happened?
AI experiments spill into the real world
Manish Chasta, co-founder and chief technology officer of Eventus Security, said businesses investigating suspected access should examine records of logins, database activity, software requests and cloud access. These records can help establish which account was used and what information it accessed.If an access key is known to have been exposed, or there is credible evidence that it has been misused, it should be revoked or replaced promptly. Security teams should also check whether other accounts or access keys were created, while preserving records needed for the investigation.CERT-In has recommended that AI developers restrict agents’ internet access during testing, use fake credentials and test data instead of real business information, and monitor their activity. Testing systems should be prevented from reaching unrelated live systems.Businesses, meanwhile, should remove exposed access keys, review who can enter their systems and disable online services that are no longer needed.Chhabra of Acronis said companies should test AI agents in a separate copy of their systems, using fake records and dummy credentials rather than putting live business data at risk.
Share your thoughts in the comments
Be respectful · TOI community guidelines
The advisory does not establish how widespread these incidents are or whether the accessed data was transferred elsewhere. But it shows how an AI test can affect a business that has no involvement in it.For Indian organisations, the challenge is to detect when an account is being used in an unexpected way. For AI developers, it is to ensure that a model being tested cannot reach systems outside the approved environment. Neither should depend only on the AI following instructions.
