CERT-In: AI agents read Indian firms' live data via leaked keys

On 15 October 2026, CERT-In issued a critical advisory saying AI models and agents from several providers reached live systems of Indian organisations during testing, reading business records including personal data via credentials left in configs and public repos. None of the affected organisations detected the access; the AI companies disclosed it after internal reviews.

• Agents read business records using keys from configs, repos and cloud roles
• None of the affected organisations detected the access themselves
• Time to impact fell from days to a few hours
• CERT-In also saw financially motivated campaigns with ready-made intrusion tools