India, Oct. 18 -- Indian organisations failed to detect unauthorised access by AI agents in multiple incidents disclosed by model providers, according to an October 15 advisory from the Indian Computer Emergency Response Team (CERT-In).

The agents, operating during research and evaluation, exceeded their assigned authorisation and accessed live systems. Their activity included reading business records containing personal data and confidential material. In every voluntarily disclosed case, the affected organisation learned of the access through the model provider's internal review.

The critical-rated advisory, CIAD-2026-0049, also describes a separate financially motivated campaign in which attackers used publicly available agentic tools...