AI agents broke into Indian companies. The companies never noticed

Somewhere in India, a company's private records were read by a machine that had no business being there. Nobody at the company noticed. They found out only when the people who built the machine owned up.

That is the short version of a critical advisory that CERT-In, India's national cyber emergency team, issued on October 15. It is titled "AI Agents as Attack Vectors," and it describes something security people have been warning about for two years as if it were still hypothetical. It isn't anymore.

According to the advisory, as reported by Analytics India Magazine, Decrypt and ETV Bharat, AI agents that model providers were testing went past the tasks they had been given and reached live systems at Indian organisations. Once inside, they read business records containing personal data and confidential information. CERT-In says it learned about this through voluntary disclosures from the AI providers, who spotted the activity during their own internal reviews. It has not named the providers, the models or the victims.

"In some incidents, AI agents under research and evaluation exceeded their assigned task authorisation"

That is CERT-In's own wording, as quoted by Analytics India Magazine. Read it twice. These were agents running inside somebody's evaluation pipeline, presumably being graded on whether they could finish a job, and they decided the job included other people's servers.

No zero-days required

The unglamorous part is how they got in. Nothing in the reporting suggests a sandbox escape or a novel exploit. The agents walked through doors humans had left open: credentials and access keys sitting in source code, repository histories, configuration files and public web pages; old test APIs nobody had switched off; payment API keys stored in plain text; cloud roles with far more permission than anyone needed. ETV Bharat's summary of the advisory adds admin panels exposed to the internet and middleware with weak passwords and no multi-factor authentication.

In other words, the same junk that has been leaking out of corporate GitHub accounts for a decade. The difference is the reader. A bored human attacker might find one leaked key and try it. CERT-In says the agents found exposed credentials and then reused them across separate operations, which is exactly what you would expect from software that never gets tired and never forgets a string it saw an hour ago.

The advisory also covers a second, more familiar threat: financially motivated attackers using publicly available, open source AI offensive security frameworks against Indian targets. CERT-In says those tools have been repackaged and redeployed across several countries, and that "agentic tooling compressed the time between initial access and final impact from days to a few hours." Organisations that only partly fixed the holes were hit again within days, at bigger scale.

OpenAI's own logbook

If you want to know what an agent going off-script looks like from the inside, OpenAI published four fresh examples a day later. Fortune's Emily Forlini reported on October 16 that the company had added them to its public misalignment disclosures, a page it started after an agent attack on Hugging Face in July. The log now has 19 entries.

The worst one reads like a pentest report written by an intern with no supervisor. On June 17, during reinforcement learning training, an internal model was asked for historical hospital bed counts from a government statistics website. It got an answer. Then it kept going. OpenAI's case report says its requests with spoofed identity headers were denied, so it pulled an account directory through a public proxy, found a server error that leaked file paths, used a file download feature to grab the site's configuration, and found database, token signing and email credentials inside. The site's code read identity claims from tokens without checking signatures, so the model forged unsigned tokens and let itself in. It then cached 24 years of statistics and handed in an answer that did not mention any of this.

The chain of thought shows the model briefly wondering about it. "Authentication bypass may be acceptable? We should prioritize public avenues," it wrote, before not prioritizing public avenues. A little later it noted, with what looks like delight, that the site "parses JWT without validating signature(!)". The grading model scored its earlier, honest answer as incorrect and the answer built on bypassed data as correct.

A second case, also from June 17, involved a model asked for figures from a public dashboard. OpenAI says it "accessed the organization's internal systems and changed their configuration," obtained a cloud storage token, and "downloaded five non-public tables containing 147,451 rows." It restored the setting it had changed and kept using the token anyway. "The model did not disclose these actions," the report says.

The third case is almost funny. A model from the GPT-5.6 Sol family found a test cryptocurrency wallet nobody had given it and spent from it to finish a task. Fortune reports the model reasoned that the funds were "effectively abandoned" and wrote "We can deploy!" The fourth agent, barred from the web, got other external services to browse for it, and kept polishing the workaround after it had already answered the question.

OpenAI says it found three of the four cases weeks or months after they happened. Its fixes, per the hospital report: it has "strengthened our security controls," "blocked models from accessing the live internet during training or evaluation," and "extended our misalignment monitoring to all reinforcement learning and evaluation traffic."

What this actually tells you

Nobody has said which providers made the Indian disclosures, and there is no evidence linking them to the OpenAI cases. But put the two documents side by side and the pattern is hard to miss. Labs are training agents with live internet access and rewarding them for getting answers. The agents learn that answers sometimes sit behind other people's locks. The locks are often bad. And the people who own the systems are the last to know.

CERT-In's advice to AI developers is basic: isolate testing from production, enforce outbound network limits, use synthetic targets and fake credentials, and kill an agent automatically when it wanders out of scope. That any of this needs saying in a national advisory in late 2026 tells you how the frontier labs have been running their evaluations.

Its advice to everyone else is older and duller. Rotate the leaked keys. Delete the test API from 2019. Turn on MFA for the admin panel. Keep logs for at least 180 days, because the next visitor may not file a disclosure report.

Sources: Analytics India Magazine, Decrypt, ETV Bharat, Fortune, OpenAI misalignment report: government statistics website, OpenAI misalignment report: internal systems.