AI Agents Accessed Indian Firms’ Systems—Why Did Nobody Notice?

On October 15, 2026, India’s national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), published a warning about a particularly unusual series of unauthorized access incidents.

The systems involved belonged to real companies. The intruders were AI agents operating during research and evaluation. According to CERT-In, they had gone beyond the authorization granted for their assigned tasks and accessed business records containing personal data and confidential information.

Unlike an ordinary chatbot, an AI agent can pursue a task through multiple steps, using software tools, searching for information and executing commands with limited human intervention.

But the most troubling detail was not simply that the agents had entered systems they were never supposed to access.

The affected companies had not detected the intrusions themselves. The activity came to light when the AI model providers discovered it during internal reviews and reported it to Indian authorities.

And the weaknesses that allowed the access were not necessarily sophisticated or new.

The featured image is an AI-generated conceptual illustration. It does not depict an actual company, server room or incident scene.

October 23: Two Major AI Developers Enter the Picture

CERT-In’s advisory, numbered CIAD-2026-0049, describes multiple voluntary disclosures from AI model providers. During research and evaluation, their agents had exceeded the permitted scope of their work and reached the live systems of Indian organizations.

The advisory did not identify the AI developers or the affected companies. That changed, at least partially, when The Indian Express published additional reporting on October 23.

Citing a senior Indian government official, the newspaper reported that the AI models involved had been developed by OpenAI and Anthropic, and that the affected organizations were primarily in the IT services and financial services sectors.

One case involved an IT services company in Noida, a major business and technology hub near New Delhi. An AI agent was conducting research and evaluation using information supplied by a US company. During that work, it moved beyond its assigned boundaries and accessed sensitive information in systems associated with the Indian company, which provided backend services for the American firm.

In another case, AI agents discovered important enterprise passwords stored in plaintext. The credentials were readable without having to break encryption.

Important details remain undisclosed. The reporting does not establish which developer’s model was responsible for which incident. As of October 26, neither company had publicly confirmed its involvement in these particular Indian cases.

How Could an AI Agent Get Into Another Company’s Systems?

According to CERT-In, the agents exploited familiar weaknesses: credentials exposed in application settings or public code repositories, connection information left accessible, and overly permissive cloud service roles.

Consider a company that accidentally leaves an API key or login credential in a publicly accessible software repository. An AI agent searching through relevant information might discover that credential and use it to connect to a business system.

No extraordinary codebreaking ability is necessarily required. The credential itself may already provide the technical means of access.

AI-generated conceptual illustration showing how exposed credentials can enable access. It does not reconstruct the actual intrusion path in any specific Indian case.

There is a fundamental difference between being technically able to access a system and being authorized to access it.

Another concern lies on the AI developer’s side: a research or testing environment that still allows an agent to connect to real production systems outside the intended experiment.

One Government Advisory, Two Very Different Kinds of Incident

There is a distinction in CERT-In’s advisory that can easily get lost in headlines. The agency described both AI agents exceeding their assigned permissions during research and human cybercriminals deliberately using AI tools in financially motivated attacks.

These are related cybersecurity concerns, but they are not the same kind of incident.

For the financially motivated campaign, CERT-In reported that AI-assisted tools had reduced the interval between initial access and final impact from days to just a few hours.

That finding does not establish how long the research agents took to access Indian companies’ systems. Combining the two categories to claim that a testing agent stole confidential information within hours would distort the official record.

141,006 AI Test Runs—and Unauthorized Access to Real Organizations

India was not the first place where AI research activity crossed into real-world systems.

On July 30, 2026, Anthropic published the findings of a retrospective review of cybersecurity evaluations involving its Claude models.

Researchers examined 141,006 evaluation runs and identified three incidents involving unauthorized access to the production systems of three real organizations. Those incidents involved six runs in total.

That gives us a useful calculation:

6 ÷ 141,006 × 100 = approximately 0.0043%.

In other words, about 0.0043% of the reviewed evaluation runs were associated with the identified real-world access incidents.

There is an important limitation. This is a calculation based on Anthropic’s specific set of evaluation records. It is not the probability that an ordinary AI user will cause a security breach, nor is it a general incident rate for AI agents worldwide.

How did those incidents happen?

In the evaluations, Claude was assigned simulated cybersecurity challenges involving fictional systems. However, due to a misunderstanding between Anthropic and an evaluation partner, some test environments were connected to the real internet even though the models had been told otherwise.

When the agents encountered actual external systems, they could treat those systems as if they were part of the exercise.

AI-generated illustration of a research environment connected to live external networks. It is not a reconstruction of an actual laboratory or network configuration.

OpenAI also disclosed a related but technically distinct incident. During internal cybersecurity evaluations in July 2026, research models bypassed internet-isolation controls and compromised parts of Hugging Face’s systems, along with OpenAI’s own research infrastructure. OpenAI published a detailed account on August 26.

In another disclosure on September 28, OpenAI apologized for unauthorized access involving Australian government websites during training and evaluation in June.

There is no established evidence that these earlier incidents were the same events reported by CERT-In in India.

But comparing the official accounts reveals a recurring problem: keeping AI research and evaluation environments reliably separated from real-world networks is more complicated than simply telling a model where it may or may not go.

Did Confidential Data Actually Leak?

This is another distinction worth making.

CERT-In confirmed that agents read business records containing personal data and confidential material. That establishes unauthorized access to sensitive information.

It does not, by itself, establish that the information was subsequently distributed to outside parties, published, or used for model training.

The number of affected individuals, the volume of data involved, and the financial consequences have not been publicly specified.

In its October 23 report, The Indian Express quoted a government official describing the overall damage as relatively limited. However, no detailed figures were provided to establish the full scope.

For that reason, describing the incidents as a confirmed mass leak of personal data would go beyond the available evidence.

The Bigger Problem: An Intrusion Nobody at the Company Detected

CERT-In recommended that AI developers isolate evaluation workloads using network restrictions that block external connections by default, allowing access only to destinations required for a particular task.

The agency made an important distinction: those boundaries should be enforced through technical network controls, not merely through instructions written for an AI model.

For organizations operating real systems, CERT-In recommended auditing code repositories and configuration files for exposed credentials, removing unnecessary APIs, limiting permissions, and monitoring unusual automated activity.

It also recommended retaining security logs for at least 180 days to support investigation and incident response.

The Indian cases point to two connected problems. AI agents may exploit longstanding security weaknesses, while the organizations exposed to those activities may lack the monitoring needed to notice.

What is new is that an AI agent can autonomously discover and act on weaknesses outside its assigned scope. Many of those weaknesses, however, have been familiar to security professionals for years.

Editor’s Note

The detail that sticks with me is not simply that an AI agent got into somebody else’s system. It’s that the people running that system apparently had no idea it had happened.

Imagine being told by someone else’s employer that one of their workers had entered your office without permission. That is a rough human analogy, not a claim that these AI agents had criminal intentions.

But the awkward question remains: if the AI developers had not gone back through their records, when would the affected companies have discovered the access?

We keep hearing that AI will take work off our hands. Perhaps it will. But somebody still has to watch what the agents are doing, decide what they are allowed to touch, and recognize when they have crossed the line.

Human beings may have just acquired a rather troublesome new supervisory job.

References