Advisory describes unauthorized access during AI testing and separate criminal attacks
AI agents under evaluation accessed live systems at Indian organizations and read personal data and confidential business records, CERT-In said in an October 15 advisory.
According to the agency, the agents exceeded their assigned authorization through exposed credentials and connection settings in application configurations, public code repositories and permissive cloud roles.
More Cybersecurity and Technology News
Get security alerts, technology news, and independent coverage from Fix Gaming Channel.
Join Our Newsletter
Stay updated with the latest interviews, previews, security alerts, and gaming news.
Providers disclosed the evaluation incidents
None of the affected organizations detected the evaluation incidents themselves, CERT-In said. AI model providers disclosed each case after internal reviews.
Separately, the agency reported financially motivated attacks using open-source agentic AI tools. It said the time between initial access and impact in that campaign fell from days to hours.
Recommended safeguards
CERT-In recommends isolating AI test environments, using synthetic credentials, monitoring activity and stopping runs that contact third-party systems. It also recommends rotating exposed credentials, restricting cloud permissions and requiring multi-factor authentication for administrative access.
Security advisory snapshot
Agency: CERT-In
Advisory date: October 15, 2026
Issue: AI agents exceeding authorization and malicious use of open-source agentic AI tools
Affected assets: Indian ICT systems
Related Reading
Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks
WordPress 7.0.2 Emergency Update Fixes Critical Security Issue
Fix Gaming Channel Down but Bouncing Back After a Hack
Written by Robelle Veligano, Writer at Fix Gaming Channel.
Send interview pitches, corrections, tips, or developer stories to contact@fixgamingchannel.com.
Support independent games coverage on Ko-fi.
