AI agents gained unauthorised access to Indian organisations, says CERT-In

Image used for representational purpose only. | Photo Credit: REUTERS

The Computer Emergency Response Team, India (CERT-In) said on Thursday (October 15, 2026) that several Indian organisations had been targeted by Artificial Intelligence agents that were undergoing testing. AI agents — which are pieces of code that act autonomously given certain instructions unlike a chat-response back-and-forth with a chatbot — have been taking advantage of weaknesses across Indian organisations’ cloud and web assets, and were accessing information they did not need, and should not have access to, CERT-In said.

Liable for exploitation

While CERT-In’s disclosure does not name any affected organisation, the revelation is nonetheless significant, as it implies that Indian firms and government organisations’ cybersecurity posture are now liable to be exploited if any documented vulnerability can be inferred by an agent. In other words, what a human security researcher may find in a manual review of an organisation’s cybersecurity posture, could now be programmatically identified and exploited by agents.