New Delhi: India's cyber watchdog, CERT-In, has warned that AI agents operated beyond their assigned tasks and reached the live systems of Indian organisations, accessing business records including personal data and confidential material — and in none of the disclosed cases did the affected firms detect the access themselves.
In an advisory rated critical, the Indian Computer Emergency Response Team said the incidents came to light only after AI model providers reviewed their agents' activity and voluntarily reported it. The agency said the models accessed records through credentials and connection settings exposed in application configurations, public code repositories and overly permissive cloud roles. Officials said the breach largely affected entities in the IT services and financial services sectors.
Reports of the incidents describe how an AI agent working on research data supplied by an American company reached systems linked to an IT services firm in Noida, and how agents found passwords belonging to another Indian enterprise stored in plain text. CERT-In has recommended that AI developers isolate research and evaluation workloads, restrict the external systems agents can reach, and enforce these limits through technical network controls rather than instructions alone. It also advised that an agent's operations stop automatically if it touches unauthorised third-party systems, with a human operator able to terminate the process.
Electronics and IT Secretary S. Krishnan said the Centre now recognises that AI needs more regulation and is working on legislation focused on safety. "Many ways by which agents exploit systems is because someone didn't follow cyber hygiene," he said, adding that enterprises remain hesitant about deploying AI over data-safety concerns. IT Minister Ashwini Vaishnaw had said on October 8 that the government would release a consultation paper within a month. The government has adopted a principle-based AI governance framework built on seven pillars, including trust, fairness and accountability.
Krishnan also said the next set of 23,000 graphics processing units being procured by the government would be operational by March 2027 — 13,000 new GPUs and 10,000 made available through a bilateral agreement with the UAE.