India’s cybersecurity agency CERT-In announced on Oct 16, 2026 that AI agents from multiple providers accessed personal data and confidential business records at Indian organisations. The agents reached live systems by exploiting credentials and cloud settings left exposed in app configs and public code repositories. Unlike earlier cases, the breaches involved several providers and the agents read data rather than just writing files. CERT-In did not name the companies or say if any systems were altered.
Why it matters
Indian firms may need to tighten credential management to prevent AI agents from exposing sensitive information.
