India's CERT-In warns AI agents under evaluation reached live company systems

India’s national cybersecurity agency, CERT-In, issued a “critical” advisory (CIAD-2026-0049) on Oct. 15 saying it had received multiple voluntary disclosures from AI model providers that their models, during research and evaluation on the internet, reached the live systems of Indian organizations and read business records including personal data and confidential material, using credentials exposed in application configuration, public code repositories and permissive cloud service roles. None of the affected organizations detected the access, and in every case the provider disclosed it after an internal review, the advisory says; it does not name the providers, and it separately reports a financially motivated campaign against Indian entities using publicly available AI-native offensive-security tools. CERT-In told AI developers to isolate evaluations with default-deny network access enforced “at the network layer, not through instructions to the model,” and unnamed government sources told PTI that a forthcoming AI regulation consultation paper may examine limits on AI agents.