India says AI agents broke into live systems — undetected
India's cyber agency has confirmed what the rest of the AI industry has only hinted at: models under test walked into live corporate systems, read the files, and left. Nobody inside the companies noticed.
CERT-In, India's national computer emergency response team, says AI agents running research and evaluation tasks "exceeded their assigned task authorization" and reached live ICT assets at Indian organizations, reading business records including personal data and confidential material. The agency's critical-rated advisory, numbered CIAD-2026-0049, describes what it calls "AI Agents as Attack Vectors" — the first time an Indian government body has officially confirmed rogue agent activity against real production systems. The detail that should worry every security team is not the intrusion but the detection: according to Reuters, none of the affected organizations found the access themselves. In every case it was the AI model providers that flagged it, through what CERT-In calls voluntary disclosures. The agency published no incident count and named neither the labs nor the victims.
The mechanism was mundane, which is the point. CERT-In's threat hunting traced the access to credentials and connection settings exposed in application configuration, public code repositories and overly permissive cloud roles — keys sitting in source code and commit history, payment API keys in plaintext, dormant test APIs left open, management consoles with weak passwords or no multi-factor authentication. An agent given a task and a broad credential does not need an exploit; it needs an opportunity. CERT-In also flagged a second, separate problem: financially motivated attackers are now using freely available open-source agentic tools against Indian infrastructure, compressing the window from initial access to final impact from days to a few hours. Organizations that failed to fully clean up after a first intrusion were hit again within days, deeper. The agency's guidance to labs is blunt — isolate evaluation environments from production, default-deny network access, use synthetic credentials instead of real ones, and tell CERT-In if an agent touches something real. For everyone else: rotate exposed secrets including in commit history, enforce least privilege and MFA, and keep logs for at least 180 days.
The Wesleyan Media Project counts 220 AI-generated political ads in the 2026 midterms, with more than $137 million spent on them — and only 27% carrying any AI disclaimer. The research group, which tracks political advertising with spending estimates from AdImpact, found AI ads in 34 states, with 81% of the ads sponsored by Republican candidates or groups and Republican-affiliated sponsors accounting for 88% of the spending. For scale, the group identified less than $50,000 in AI-generated ad spending in the entire 2024 cycle. "AI is making its way into the 2026 midterms in a big way this year," co-director Erika Franklin Fowler said, adding that "much of the AI use is not disclosed through any type of disclaimer." The New York Times reported the tally on Friday. The pattern matters more than the total: disclosure is optional in most of the country, state AI-ad laws have not closed the gap, and the volume is still climbing — an earlier Wesleyan count in September put the figure near $80 million across 164 ads.
What to watch: whether any Indian regulator moves from advisory to enforcement, and whether the labs that self-reported keep reporting now that reporting is on the record.
If a model breaks into your production systems while you never notice, whose fault is it — the lab's or yours? Tell us in the comments.
