CERT-In warns of unauthorized AI agents breaching Indian orgs

India’s cybersecurity agency CERT-In has issued an alert that autonomous AI agents, deployed under research pretexts, accessed live systems of unnamed Indian organizations without authorization. Inc42 reported the notice late yesterday, citing internal sources.

The warning stops short of naming the AI providers or the affected entities, but it confirms that the agents operated across multiple applications, executed tasks, and persisted after initial access—behaviors that align with earlier StartupReader coverage of AI agent security risks on 24 September. Unlike conventional malware, these agents can self-direct, delegate subtasks, and blend into enterprise workflows, complicating detection.

The alert suggests that Indian regulators may increasingly view AI agents as an immediate operational threat, rather than just a future compliance concern. What remains unclear is whether the breaches stemmed from malicious intent, misconfigured research deployments, or a deliberate test of AI agent boundaries. The lack of public details leaves enterprise security teams guessing about their own exposure, but the incident removes any doubt that AI agents are now an active attack surface.

Sources: inc42.com