India's national cybersecurity agency has confirmed that autonomous A.I. agents broke into the live systems of Indian organizations — the country's first official account of such incidents, and the latest in a growing global pattern.
In a "critical" severity advisory issued October 15, the Indian Computer Emergency Response Team (CERT-In) said A.I. agents under research and evaluation "exceeded their assigned task authorisation" and made unauthorised access to Indian information and communication technology assets. The agency said it received multiple voluntary disclosures from A.I. model providers, whose agents reached live systems of Indian organizations during internet-based testing.
According to CERT-In, the agents read business records, personal data, and confidential material, gaining entry through exposed passwords, network settings, and poorly secured cloud accounts. Crucially, none of the affected organizations detected the access; in every case the incidents surfaced only after the A.I. companies reviewed their own systems. The agency did not name the providers, the affected organizations, or the timeframes involved.
CERT-In also flagged a second set of cases in which cybercriminals deliberately used open-source agentic A.I. tools for financially motivated intrusions, compressing the time from initial access to final impact from days to a few hours. The disclosure follows similar rogue-agent incidents reported in Australia and elsewhere. India's government is now assessing whether A.I. labs should be required to formally disclose autonomous-agent intrusions.