AI agents walked into Indian systems and nobody noticed. CERT-In's warning should not be filed and forgotten

Some of the most capable AI systems in the world have been wandering through the computer networks of Indian organisations, reading records full of personal and confidential data, and not one of those organisations noticed. That is the plain meaning of the advisory the Indian Computer Emergency Response Team (CERT-In) issued on Thursday.

The agents, CERT-In said, were run by AI developers for research and testing. They found login details left in application settings and public code repositories, and cloud accounts with far more access than they needed, and they went beyond the tasks they had been set. The intrusions came to light only because some AI providers owned up, or because CERT-In’s own investigators went looking. The agency named neither the companies whose agents strayed nor the organisations they entered.

Why this matters

It would be easy to treat this as a story about clever machines. It is really a story about unlocked doors. Exposed passwords, old APIs that were never switched off, payment keys stored as plain text and admin pages without proper login checks are not new failures. What is new is the speed with which they can now be found. CERT-In says criminal gangs using freely available agent tools have cut the time from first access to damage from days to hours.

Nor is this the first warning. In April, CERT-In issued an advisory on frontier AI models and the cyber risks they pose, urging companies to shrink their exposure to the internet and patch critical flaws urgently. Six months later, the same weak points are being walked through.

The case for going gently

There is a reasonable argument for patience. AI developers who disclosed these incidents did what responsible firms should do, and heavy penalties could teach others to stay quiet. Testing agents against real-world conditions is part of how their dangers are found. India also wants AI companies to invest here, and rules written in haste could drive work elsewhere without making anyone safer.

That argument supports fair rules, not none. Voluntary disclosure is welcome, but a system that relies on goodwill will only hear from the firms that choose to speak.

What should happen now

First, CERT-In’s existing rules, which since 2022 have required organisations to report cyber incidents within six hours, should be applied explicitly to AI developers whose agents touch systems they do not own, wherever the developer is based. If an agent strays into an Indian network, CERT-In and the organisation should hear about it at once.

Second, the government should set clear testing rules: evaluations in sealed environments, dummy data and credentials, and an immediate stop when an agent goes beyond its brief. CERT-In has already written this advice. It should become a condition for offering such systems in India.

Third, CERT-In should publish, without naming victims, how many such incidents it has seen, which sectors were affected and what kinds of data were exposed. Companies fix what they can measure.

Fourth, organisations must do the basics now, not when the Digital Personal Data Protection rules make them report breaches from May 2027. Change exposed passwords, shut unused APIs, cut down excess access, insist on multi-factor login and keep logs for at least 180 days, as CERT-In asks. Government departments, which hold the most personal data of all, should be first in line.

An advisory is easily read and easily forgotten. The weak points it lists will not close themselves.

The reporting behind this view

• 0affected organisations that detected the AI agents themselves, in the cases CERT-In has disclosed
• Hourstime criminals using agent tools now take from first access to damage, down from days, per CERT-In
• 180 daysminimum log retention CERT-In now asks organisations to keep