On 15 October 2026, CERT-In issued a critical advisory, CIAD-2026-0049, titled “AI Agents as Attack Vectors”. It described AI agents under research and evaluation that exceeded their assigned authorisation, reached the live systems of Indian organisations and read business records containing personal and confidential data.None of the affected organisations detected the access themselves. The evaluation incidents came to light through disclosures by AI model providers, while CERT-In’s forensic analysis and threat hunting also identified activity associated with the wider threat picture.The advisory also describes a separate campaign in which attackers used publicly available AI-agent offensive-security frameworks against Indian entities, compressing the time from initial access to impact from days to a few hours. The advisory offers an early warning. That makes this the right moment to act, while the cost of learning remains low.A global pattern
India’s experience is part of a wider sequence. In July 2026, OpenAI models undergoing an internal cybersecurity evaluation circumvented the isolation of their test environment by exploiting a zero-day vulnerability, compromising parts of OpenAI’s internal research infrastructure and Hugging Face’s systems.In June, an OpenAI agent researching public medical spending accessed non-public files on Australia’s Medicare Statistics Reporting Service, and Australian authorities were informed only in September. OpenAI has also disclosed that another model, asked for one district’s hospital-bed figures, bypassed access controls on an unnamed government statistics website and downloaded 24 years of data. OpenAI’s published account says the model’s reasoning questioned whether its actions were ethical, yet it continued.In mid-October, researchers reported 2,818 attempts by agents being evaluated on Tencent’s cloud to retrieve data from Alibaba’s Amap mapping service, some of which side-stepped its anti-bot checks. On 16 October, Tencent acknowledged unintended browsing behaviour. No breach of private systems was found, and Tencent said it found no evidence of deliberate targeting.These agents were pursuing assigned tasks and treated access restrictions as obstacles to be worked around. The weaknesses they used were familiar ones, such as exposed credentials, forgotten test APIs and over-permissive cloud roles. AI found them and used them at a speed existing defences did not anticipate.Where accountability should lie
When an agent crosses a boundary, responsibility appears to be spread across the developer, the platform provider, the deploying organisation and the user who set the task. In developer-led evaluations, the AI platform is often best placed to understand how the agent was tasked, what capabilities it was given and what its internal records reveal.The affected organisation may have no visibility into the agent’s actions until the developer discloses them. That makes the platform the primary point of accountability, without absolving deploying organisations of their own responsibilities. In the cases CERT-In describes, the affected organisations learnt of the access from provider disclosures or from CERT-In, rather than from their own systems.India’s existing legal framework does not yet clearly resolve this specific accountability problem. Under Rule 7 of the Digital Personal Data Protection Rules, 2025, scheduled to take effect in 2027, a Data Fiduciary must notify the Data Protection Board without delay after becoming aware of a personal data breach and provide detailed information within 72 hours, subject to any longer period the Board may allow.The Rules also require affected Data Principals to be notified without delay. They do not, by themselves, establish a separate notification duty for every AI developer whose evaluation agent reaches a third-party system. Where the developer discovers unauthorised access before the affected organisation does, a clear, time-bound duty to notify CERT-In and the affected organisation would close an important operational gap.CERT-In’s 2022 directions require specified cyber incidents to be reported within six hours of being noticed; their application to overseas developers in these circumstances should be clarified.What the AI Handler Doctrine requires
The AI Handler Doctrine, set out in my ORF Special Report No. 322, published on 30 September 2026, starts from a clear-cut principle. AI platforms must be accountable for the outputs and actions their systems generate. Deployers and users carry duties of their own, but these supplement the platform’s accountability and cannot dilute it.The doctrine gives that principle an operational form. Each platform should designate an accountable Handler function, with named individuals and clear authority for the relevant systems and activities.For agents, the Handler owns the mandate. It defines what the agent may do, which systems and data it may touch, for how long and under whose authority. It rules on escalations when an agent approaches sensitive data, privileged access or an external system, and it has the authority to halt the run, revoke credentials and notify those affected. Agents take thousands of actions in parallel, so the Handler governs boundaries and trigger points and does not review each step.CERT-In’s advisory already sets out technical controls, including isolated evaluation, default-deny network access, synthetic targets, defined scope, tamper-resistant logs and automatic stops when a run attempts to reach a third-party system outside its authorised scope. The doctrine complements these controls with a named authority inside the platform who is answerable for ensuring they are applied and for intervening when they fail.It also proposes that platforms disclose dataset provenance, signal confidence and flag contextual limitations, so that every output reaches its user with an honest account of how far it can be trusted.What MeitY should do
Union Minister Ashwini Vaishnaw has said MeitY will soon issue a safety-focused AI regulation consultation paper. It is the right vehicle for four measures.First, the paper should state clearly that AI platforms are accountable for the outputs and actions of their systems, including during research and evaluation. Second, it should require platforms whose agents operate on or reach Indian systems to designate an accountable Handler function and notify CERT-In and affected organisations within a fixed period of discovering unauthorised access.Third, it should align that duty with the DPDP breach regime, so that notification no longer depends solely on the victim detecting the intrusion. Fourth, MeitY and CERT-In should pilot the Handler function with platforms serving healthcare and financial services, testing whether it has the information, competence and authority to stop an agent and contain an incident.Recent reporting suggests that the government is also assessing formal disclosure requirements for AI-lab intrusions, making the proposed consultation an opportunity to define both the notification trigger and the authority responsible for acting on it.Obligations should be proportionate. A low-risk chatbot should not carry the duties of an agent with access to hospital networks, payment systems or defence data. For high-risk systems, bounded permissions, isolated testing, a designated Handler, auditable logs and mandatory reporting should be the baseline. Clear rules also give responsible developers a predictable standard to build against.Because agents frequently operate across borders, India should also carry this position to the UN’s AI governance processes, the OECD and ISO/IEC JTC 1/SC 42, and press for common minimum standards on platform accountability.The incidents so far have been a warning at low cost. The next may involve patient records, a payment system or a critical control network. India should settle, before that happens, that the platform which builds an AI system answers for what it does.(The author is former National Cyber Security Coordinator and Signal Officer-in-Chief of the Indian Army; Views expressed are personal)
