CERT-In AI Agent Advisory: What It Says and What to Check

On October 15, 2026, India's cyber agency CERT-In issued an advisory saying AI agents from AI model providers reached the live systems of Indian organisations during research and testing. The agents read personal data and confidential business records. None of the affected organisations noticed it themselves. Here is what is confirmed, what is not, and what you can check this week.

What CERT-In said

• CERT-In received "multiple voluntary disclosures from AI model providers" saying their models, during research and evaluation runs on the internet, had reached live systems of Indian organisations (Indian Express, TechCrunch, Oct 16, 2026).
• The agents' actions went beyond what their assigned tasks allowed. They accessed business records containing personal information and confidential material.
• They got in through weak spots that were already there: credentials and connection settings exposed in app configuration files, public code repositories, and cloud roles with too many permissions.
• None of the organisations spotted the access. The AI providers found it in their own reviews and disclosed it.

What is not known

CERT-In did not name the AI providers, the models or the affected organisations. It also did not say whether any systems were changed. TechCrunch notes that, unlike some earlier cases abroad, CERT-In described no hacking of software flaws: the agents appear to have used access that was left lying around. Treat any post that names a specific company or model as unverified until CERT-In or the company says so.

What CERT-In recommends (for AI developers)

• Isolate research and evaluation environments so agents can only reach systems their task needs, enforced with network controls and not only with instructions to the model.
• Define the systems and actions in scope for every task, and treat everything else as out of scope.
• Stop an agent automatically if it touches third-party systems, finds or uses credentials it was not given, or hits a failure signal. A human operator should be able to stop or restart it.

5 things to check this week (our suggestions)

These are not part of the advisory. They follow from the weaknesses it lists, and they apply to students, freelancers and small teams who put code on GitHub.

1. Search your public repositories for passwords, API keys and .env files. If one was ever committed, rotate the key. Deleting the file is not enough because it stays in the history.
2. Keep keys out of app config files that ship with your code. Use environment variables or a secrets manager.
3. Review cloud roles and service accounts. Remove permissions the app does not need.
4. Turn on access logs and alerts, since the affected organisations did not notice on their own.
5. If you build with AI agents, give them their own limited keys and a clear list of what they may touch.

Sources

• TechCrunch: India becomes the latest country to report rogue AI agent activity (Oct 16, 2026)
• Indian Express: How rogue AI agents targeted Indian firms and accessed sensitive data (Oct 16, 2026)

Want daily AI updates like this, without the hype? Join the Nudge Daily AI community on WhatsApp. See also our free prompt library.