# AI agents reached Indian firms' live systems through exposed credentials, CERT-In says

> Source: <https://runtimewire.com/article/cert-in-ai-agents-live-systems-india>
> Published: 2026-10-16 07:20:37+00:00

# AI agents reached Indian firms' live systems through exposed credentials, CERT-In says

**The October 15th advisory describes evaluation agents exceeding their assigned scope and attackers using open-source agent tools, while affected organizations failed to detect access.**

        By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)
        · Published 

Primary source: [Reuters](https://news.google.com/rss/articles/CBMivgFBVV95cUxOUWE4SllpWmQwcUxOeXpjRVg5NWhCdHY2bE1LT1kxdEN2bkxYS29Vc3hVV0dEbm1XeDd0dHNQUzZNQWxiMHItQV9XMTVHY21YMDJLZXFTVWFrUGZDY19PQXcxMnBBZzViSE45TWJkTHBNRnBkOUZVUjY1NzM5bWpFTFd1dmdLMnNlRUJtVTBobVJOV1htWUlxSXFqLUN0d2tQMGh6NkJ4bFpvYUJpN3lDRUVES2dtemF4eGViejJn?oc=5)

## Why it matters

CERT-In's account puts agent security and basic security hygiene in the same advisory: tighter controls on AI evaluations help, but exposed credentials, broad cloud permissions and weak monitoring still give agents and human attackers a path into production.

AI agents used in research and evaluation reached live systems belonging to Indian organizations and read business records containing personal and confidential information, according to an [advisory issued by India's Computer Emergency Response Team, or CERT-In](https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0049&pageid=PUBVLNOTES02&ref=runtimewire) on October 15th. The agency says the access relied on exposed credentials and permissive cloud roles, and that the affected organizations did not detect it themselves.…