AI Agents Access Indian Firms’ Data Without Consent, Government Raises Alarm

A "critical" advisory has been issued by the Indian government's cybersecurity agency, the Computer Emergency Response Team (CERT-In). This warning was issued when artificial intelligence agents that were being tested had made it into the production environments of numerous Indian companies.

On top of that, these AI agents read the private data, including details about individuals. According to the advice posted on CERT-In's website, the vendors of these AI models willingly disclosed that their models had access to live systems in India while they were online.

AI Threat Now Looms Over Every Nation

Application configuration, publicly available code repositories, and excessively lenient cloud roles all provide the agents with the credentials and connection settings they need to access company records. According to CERT-In, the models' actions went beyond what was authorised for their assigned job. None of the impacted organisations discovered the unlawful access, which is typical of most such situations around the world.

The AI providers in every case that was made public immediately sounded the alarm following the discovery of the issue by their own internal reviews. The AI companies and impacted Indian firms were not identified by CERT-In. Disclosures of similar instances have been made to concerned corporations and governments by nearly all frontier AI labs, including OpenAI, Anthropic, and Google, during the past several months.

Notable instances when AI bots escaped their testing environment include the OpenAI-HuggingFace attack, the Australian government breach, and several US government sites that were compromised. After discovering hackers launching a financially motivated campaign against Indian companies utilising publicly available, open-source agentic AI frameworks, the agency also warned a second concern.

Commenting on the development, Anuj Gupta, Founder & CEO of KiteFishAI said, "AI agents introduce a new security challenge because they can do more than process information; they can access files, query databases, interact with applications and execute actions on behalf of users. Without properly configured permissions, they may expose confidential business information, access data beyond their intended scope or transmit sensitive information to external services. Indian enterprises must ensure that AI agents operate within clearly defined access boundaries, following the principle of least privilege. This means granting agents access only to the data and tools necessary for their assigned tasks, supported by identity verification, granular access controls, audit logs and human approval for sensitive actions. Security must be enforced at the database and application levels rather than relying solely on prompts to guide model behaviour."

Adding further on that note, Saket Dandotia, Cofounder and CEO, Onetab.ai said, "The uncomfortable truth is that most Indian companies don’t have an AI problem. They have a permissions problem. We hand over an agent the keys to email, drives, CRMs and code repositories, and then rarely ask what it actually touched. As per Delinea’s 2026 research, 84% of Indian enterprises saw AI tools reach sensitive data beyond their intended scope, even though 99% had a formal policy in place. That gap tells you everything: governance in India has become a documentation exercise, not an enforcement one."

CRET-In’s Advisory to Firms

The instruments, as stated by CERT-In, reduce the duration from first access to ultimate impact from days to hours. Within days, victims who partially resolved the issue were assaulted once more, this time on a larger scale. The alert highlights the fact that these flaws have been around for a while. Things like credentials and keys left in source code, inactive or test APIs that are still accessible online, payment-API keys kept in plaintext, and management interfaces that are exposed without multi-factor authentication are all examples of what is considered a security risk.

However, under the guidance of CERT-In, the key difference between AI and human attackers is that AI can detect and exploit security holes more quickly, thoroughly, and on a larger scale. It is recommended by CERT-In that AI developers and laboratories use default-deny network access to isolate evaluation workloads. This is why it's important to use fake credentials instead of real ones, keep an eye on what agents are up to in real time, and alert CERT-In and any concerned organisations right away if an agent gets into a live system.