Faisal Mahmud
17 October 2026•Update: 17 October 2026
Autonomous artificial intelligence (AI) agents accessed Indian computer systems without authorization during research and testing, India's cybersecurity agency said Thursday.
In an advisory issued Oct. 15, Indian Computer Emergency Response Team (CERT-In) said AI model developers had voluntarily disclosed multiple incidents in which autonomous agents exceeded their assigned tasks and accessed live systems belonging to Indian organizations.
According to CERT-In, none of the affected organizations independently detected the unauthorized access.
The agency also identified financially motivated cyberattacks involving publicly available AI-powered offensive security tools.
Some organizations were attacked again within days after failing to fully address their security vulnerabilities, it added.
CERT-In urged AI developers to restrict autonomous agents' internet access and conduct testing in simulated environments rather than live systems.
It also called on developers to immediately report unauthorized activity involving their AI tools.
The agency advised organizations to strengthen authentication, remove exposed credentials and improve monitoring for automated cyberattacks.
It also recommended retaining security logs for at least 180 days to support the detection and investigation of security incidents.
