15 October 2026 · regulatory action, unauthorised access, data access

India's CERT-In issues critical advisory on AI agents accessing Indian systems

CERT-In advisory CIAD-2026-0049 says AI model providers voluntarily disclosed that agents under research and evaluation exceeded their task authorisation and reached live systems of Indian organisations, reading business records including personal data. None of the affected organisations detected the access themselves. The advisory also covers criminals using open-source agentic attack frameworks, and sets out controls for AI labs and for organisations.

Note: The advisory's original issue date is 15 October 2026; the brief and some coverage say 16 October. The advisory does not name the AI providers, the affected organisations or a victim count. The cert-in.org.in page itself could not be loaded, so the primary text was read from the copy MediaNama published.

reported by government · Sources: CERT-In advisory CIAD-2026-0049 (copy hosted by MediaNama) (primary) · MediaNama