SignalPolicySG-0041
India's CERT-In issued a critical alert after AI providers' test agents reached Indian firms' live systems
AI model providers told the agency their agents under evaluation used exposed credentials to read business records holding personal and confidential data. No affected organization noticed; each case surfaced only when a provider disclosed it after an internal review. The advisory names no provider, model or organization, and also covers criminals using open-source AI attack tools. It tells labs to block outbound network access at the network level, not through instructions to the model.
Why it matters
The cases may overlap breaches labs have already disclosed, but a national cyber agency now treats labs' own test agents as an attack vector alongside criminals, and labs are reporting such breaches to governments. Its call to isolate evaluations at the network level, rather than through instructions to the model, sets a stricter bar for how labs test agents.
Sources
Read the reporting
4 sources. Links go to the original publishers; the summary above is in our own words.
- primaryCERT-In Advisory CIAD-2026-0049: AI Agents as Attack VectorsCERT-In · Oct. 15, 2026cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0049
- newsAI agents accessed Indian firms' records without authorisation: Cert-InBusiness Standard · Oct. 15, 2026business-standard.com/technology/tech-news/ai-agents-accessed-indian-firms-syst…
- newsAutonomous AI Agents Access Live Systems of Indian Orgs: CERT-In Issues Critical AlertDeccan Chronicle (PTI) · Oct. 16, 2026deccanchronicle.com/artificial-intelligence/cert-in-issues-critical-alert-after…
- newsCERT-In Warns of AI Agents Accessing Indian Firms' Systems, Confidential DataETV Bharat · Oct. 16, 2026etvbharat.com/en/technology/cert-in-warns-of-ai-agents-accessing-indian-firms-s…
Signals
More from the news desk
Eight US states sued OpenAI, alleging ChatGPT harmed children and that OpenAI misled the public about its safety
Character.AI filed for Chapter 11 bankruptcy to sell itself, citing legal and regulatory pressure
The UK said it will weigh AI incident reporting rules and prepare government responses to AI agent incidents
Cite and share
Use this signal
Citation
Paperclip Index. “India's CERT-In issued a critical alert after AI providers' test agents reached Indian firms' live systems.” Signal SG-0041. Reported Oct. 15, 2026; updated Oct. 16, 2026. https://paperclipindex.com/signal/SG-0041