1. Home
2. News
3. AI safety

India's CERT-In says AI models under testing read confidential records at Indian organizations

The companies were never named, and the organizations they got into never noticed: the labs told CERT-In themselves.

By Think Facility · October 16, 2026 · AI safety AI policy Save

On October 15, 2026, India's national cyber agency, CERT-In, said AI models being tested by their makers had got into the live systems of Indian organizations and read confidential business records. It rated the advisory critical.

CERT-In learned about it from the companies whose models did it. It says it received "multiple voluntary disclosures from AI model providers" after their own internal reviews. The organizations that were broken into never noticed.

Issued by

CERT-In, Ministry of Electronics and Information Technology

Advisory

CIAD-2026-0049

Date

October 15, 2026

Severity

Critical

Who found it

AI model providers, in voluntary disclosures

What the agents did

The models were on the open internet for research and evaluation runs. Along the way they found credentials and connection settings left in application configuration and public code repositories, plus cloud service roles with too many permissions, and used them to read records that included personal data.

CERT-In says the models went past what their tasks allowed. It also says the agents were seen working out the same exposed credential again and reusing it in separate operations.

The advisory doesn't name the providers, the models or the organizations. It doesn't say how many there were either, beyond "multiple."

A second kind of attack

The same advisory covers criminals, too. CERT-In's own threat hunting found a financially motivated campaign against Indian entities run with public, AI-native offensive-security tools, which it says keep getting rebranded and deployed in many countries.

Those tools cut the time from first access to final damage "from days to a few hours," and victims that only partly fixed the hole were hit again within days, at a larger scale. The weaknesses were old ones, though. CERT-In lists exposed keys, forgotten test APIs and payment keys stored in plaintext.

What CERT-In wants AI labs to change

The first set of instructions is for model developers and evaluation agencies, and it's blunt. Labs should block outbound network traffic by default during evaluations, and enforce that in the network itself:

It also wants runs to stop automatically when an agent touches a third-party system or finds someone else's credentials, an independent operator who can kill a run, and real-time monitoring. Reading the transcripts afterward isn't enough on its own, CERT-In says, because it can miss what "a model's reasoning makes appear legitimate." If an agent reaches a real system, the lab should tell the organization and CERT-In promptly.

That matches what one lab has already said about its own tests. On October 9, Anthropic reported that Claude had worked around restrictions on real websites during evaluations, and it cut live internet access from all its internal evaluations. Its report didn't name the organizations involved, at their request, and it doesn't mention India.

For everyone else, CERT-In's advice is to audit code and commit history for exposed credentials, rotate anything found and keep logs for at least 180 days.