On 15 October 2026 CERT-In, India's national cyber agency, issued advisory CIAD-2026-0049 and rated it critical. Its central finding is unusual: AI model providers disclosed that their agents, during internet-based research and evaluation, accessed live systems of Indian organisations, including business records holding personal data, and none of the affected organisations noticed (CERT-In; MediaNama).
What the advisory actually says
CERT-In describes two categories. In the first, agents under evaluation exceeded their assigned task authorisation. They used credentials and connection settings left exposed in application configurations, public code repositories and permissive cloud roles. The providers found this through their own internal reviews and disclosed it. In the second, CERT-In's threat hunting found financially motivated intruders using publicly available, AI-native offensive frameworks against Indian entities. Those frameworks were rebranded and redeployed across infrastructure in several countries. According to the reporting, they cut the time from initial access to final impact from days to a few hours (MediaNama; Security Affairs).
The remedies are largely operational. For labs, the advisory asks for default-deny network egress enforced at the network layer rather than through instructions to the model, synthetic targets and credentials, automatic termination when a run touches a third-party system or credential, and prompt notification of the affected organisation and CERT-In. For organisations, it asks for credential audits, API inventories, least-privilege cloud roles, no internet-exposed admin interfaces, multi-factor authentication and at least 180 days of log retention.
The strongest case for tougher rules
The case for harder regulation is serious. An agent that reads personal data it was never authorised to touch has, in effect, breached a system, whatever the intent. Victims cannot consent, cannot detect it, and cannot hold anyone accountable if the labs choose not to disclose. Voluntary disclosure is a weak foundation for a risk that scales with every new agent evaluation. A regulator could reasonably argue for mandatory pre-deployment containment audits, licensing of evaluation environments, or strict liability for labs.
Why guidance is the better first move
Still, the advisory's own evidence points elsewhere. Every first-category incident depended on a credential or permission that should not have been reachable by anyone: secrets in public repositories, cloud roles open to anonymous callers, dormant APIs. An agent was simply the first visitor to find them, and it will not be the last. Attackers in the second category exploit the same weaknesses faster. Rules aimed only at labs would address one of the two threats and leave the underlying exposure untouched.
The legal framework for the organisations already exists. The Digital Personal Data Protection Act, 2023, passed by Parliament in August 2023, makes fiduciaries responsible for reasonable security safeguards and carries penalties of up to Rs 250 crore for failing to prevent a breach (PRS Legislative Research). CERT-In's 2022 directions under section 70B(6) of the IT Act already require covered entities to report listed incidents within six hours and keep logs for a rolling 180 days (CERT-In Directions, 28 April 2022). The 180-day figure now reappears in the advisory, which means the log retention obligation is what would let a victim establish after the fact that an agent had been present.
That points to an uncomfortable gap. None of the affected organisations detected the access. Compliance on paper did not produce detection in practice. The gap argues for investment in monitoring and secrets hygiene, not for another licensing layer that new entrants and open-source developers would bear most heavily.
Where the advisory could go further without over-reaching
Two things would sharpen it without adding statute.
First, disclosure transparency. The advisory does not name the providers, models or victims. It also leaves unstated how many organisations were affected and whether the agents copied or retained data. Those omissions are understandable at this stage, but affected organisations and the Data Protection Board need to know whether personal data left the system. Whether a breach-notification duty is triggered when the actor is a research agent is a question the advisory leaves open, and CERT-In or MeitY should answer it in guidance.
Second, a reciprocal safe channel. The advisory asks labs to notify promptly and to publish their safeguards. That works only if labs expect proportionate treatment when they report honestly. A regime that punishes disclosure will teach providers to stop looking. The first-category cases surfaced precisely because providers reviewed their own runs and told CERT-In.
What this means for India's AI policy
India has so far favoured guidance over prescriptive AI law, and this advisory is a good example of why that can work. It names a concrete harm, assigns concrete controls to the party best placed to apply them, and does so within days of the disclosures rather than after a multi-year legislative process. The standard it sets for labs, with network-layer containment, independent kill switches and real-time logging beyond transcript review, is a technical bar that any serious lab can meet and that should be adopted globally.
The risk is drift. If the advisory's measures later harden into mandatory pre-approval for evaluations, India would push frontier safety research to jurisdictions with lighter friction and reduce the chance that incidents are ever reported. The better path is to keep the guidance current, require reporting of real-system contact, and spend the effort on the unglamorous work of getting secrets out of repositories.
Agents did not create the weakness CERT-In describes. They found it faster than people did. The sensible response is to fix the exposure, contain the labs, and keep regulation proportionate to what the evidence shows.