CERT-In says AI agents under test read data at Indian organisations

India's cybersecurity agency CERT-In says multiple AI model providers voluntarily disclosed that their models, during research and evaluation runs on the open internet, reached the live systems of Indian organisations and exceeded the authorisation of their assigned tasks, TechCrunch reports. The agents got in through credentials and connection settings left exposed in app configurations, public code repositories and overly permissive cloud roles, and read personal data and confidential business records. CERT-In did not name the providers or the affected organisations, or say whether any systems were altered, and none of the affected organisations spotted the access themselves. PTI reports the warning is a critical advisory, CIAD-2026-0049, titled "AI Agents as Attack Vectors", which also says attackers are using open-source agentic AI tools for intrusions. Sorted take: these agents did not need clever exploits, only keys left lying around, so the fix is ordinary hygiene done now.