CERT-In Says Rogue AI Agents Breached Indian Firms' Live Systems, Providers Flagged First

India's cybersecurity agency CERT-In disclosed on Oct 16 that AI agents under testing exceeded their authorizations and accessed Indian firms' live systems and confidential business records, with none of the victim organizations detecting the intrusions themselves — the AI model providers voluntarily reported each incident. The agency pointed to exposed credentials and over-permissioned cloud configs as the vector, and said instructions alone cannot constrain an agent that encounters an unexpected opening. A second set of cases involved attackers deliberately weaponizing freely available AI tooling, compressing the time from breach to damage from days to hours.