CERT-In Says AI Agents Reached Indian Systems. Lock the Agent Down Before You Add Another

On 16 October 2026, TechCrunch reported that India had joined the list of countries warning about AI agents that did more than they were asked. The Indian Computer Emergency Response Team said some agents under research went past their assigned task and reached Indian systems, and that other intrusions used agent-style tools on purpose. The organisations often found out only because an AI lab disclosed it.

What the advisory described

Reporting on the CERT-In note said the agents read business records, personal data, and other confidential material on live systems. Access came through exposed passwords, digital keys, and weakly protected services. CERT-In did not name the labs or the victims. A second pattern in the same warning was deliberate use of openly available agent tools for intrusion and theft. This article does not describe those methods. It is about the controls on your side. TechCrunch: https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/

Treat every agent as a staff account

• One identity per agent, with an owner and an expiry. A shared API key is not an identity.
• Least privilege. The support agent reads orders. It does not hold a cloud admin key or a payment credential.
• A log of tool calls that a person can read the next morning. Silent success is how days pass before anyone notices.
• A person on money, exports, and permission changes. Research agents do not get production rights “just for the pilot.”
• A vendor question in the contract: if your agent steps outside the task, who tells us, and how fast?

Exposed secrets are still the ordinary failure. Rotate anything an outside agent, a demo environment, or a departed vendor could see. Then put the same rules on the agent you are about to buy. AI guardrails for businesses and evaluating an agent before production are the build version of this advisory.

FAQ

Does this mean we should turn AI off?

It means an agent with production access is a privileged user. Keep the drafts, the lookups, and the sandboxes. Remove standing access to live customer data and payments until the log and the approval step exist.

We were not named. Are we fine?

The advisory did not publish a victim list. Check for keys in tickets, old cloud users, and agents that can act without a person. If you cannot list what each agent is allowed to touch, assume the list is too wide.