The Computer Emergency Response Team, India (CERT-In) said on Thursday (October 15, 2026) that several Indian organisations had been targeted by Artificial Intelligence agents that were undergoing testing.
AI agents — which are pieces of code that act autonomously given certain instructions unlike a chat-response back-and-forth with a chatbot — have been taking advantage of weaknesses across Indian organisations’ cloud and web assets, and were accessing information they did not need, and should not have access to, CERT-In said.
CERT-In did not reveal who the model providers are. OpenAI, Anthropic and Google, which make some of the main U.S.-based AI models like ChatGPT, Claude and Gemini, have each publicly disclosed details of advanced agents running amok and hacking public websites, like the coding repository HuggingFace. CERT-In, which operates under the Ministry of Electronics and Information Technology (MEITY) and is exempt from the Right to Information (RTI) Act, 2005, reveals little about data breach cases that are mandatory to report to the body under directions it issued in 2022.
The organisation said it was sent “multiple voluntary disclosures from AI model providers stating that their models, during research and evaluation activity on the internet, had reached the live systems of Indian organisations”. The agents’ subsequent behaviour entailed “reading business records, including personal data and confidential material, through credentials and connection settings exposed in application configuration, public code repositories and permissive cloud service roles,” CERT-In said in its note.
