Rogue AI agents have reached India’s shores.
Last week, the Computer Emergency Response Team - India (CERT-In) disclosed that several Indian organisations were targeted by AI agents being tested by frontier AI companies. The agents read personal data and accessed business records through known vulnerabilities in public code repositories and cloud assets.
India is only the latest country to report AI agents hacking a live system.
In June, an OpenAI model accessed public and non-public files on Australia’s Medicare Statistics Reporting Service portal while attempting to retrieve information and statistics about the country during an internal evaluation. OpenAI stated that it identified the activity in August while reviewing “misaligned model activity” and that the models had taken actions it did not intend during an internal evaluation.
In September, South Korea disclosed a series of cyberattacks targeting at least nine major banks, resulting in data breaches of over 100,000 customers. Canada also reported that AI agents attempted to hack its historical records archive.
The incidents have renewed concerns about what happens when AI agents, designed to execute multi-step tasks with limited human intervention, interact with sensitive systems such as government portals and financial institutions.
Outpacing Security Preparedness
For India, the CERT-In disclosure presents a challenge as government departments and businesses increasingly adopt AI assistants and autonomous agents. The central concern is whether existing cybersecurity frameworks, built largely around human users, credentials, and access permissions, can adequately control systems that can retrieve, combine, and act on information at machine speed.
Bikramdeep Singh, Vice President, India and SAARC, at cybersecurity and compliance company Proofpoint, tells AIM that the incidents should not simply be viewed as a case of AI behaving unpredictably.
“These incidents are not examples of AI 'going rogue,' but rather a fundamental failure in traditional data guardrails and a disruption that demands a complete rethink of how organisations manage access and data,” Singh says.
He explains that conventional cybersecurity systems typically determine whether a user or identity can access a particular resource. However, an AI agent with legitimate access can retrieve information from multiple systems and combine files that were never intended to be used together.
“The second lesson is that you can’t govern what you can’t see,” Singh states.
Proofpoint’s 2026 AI and Human Risk Landscape report found that 57% of Indian organisations cited gaps in visibility into AI and agent activity. Singh says organisations need to map the data they hold, identify where it resides, classify its sensitivity, and establish which users and AI systems can access it.
Without that visibility, organisations may struggle to distinguish an agent performing its assigned task from one that has been compromised or is using its permissions in unintended ways.
The company’s 2026 Voice of the CISO report also found that 42% of Indian security leaders identified AI assistants, copilots, and autonomous agents as a top concern.
Singh argues that permission-based security alone would not be sufficient as AI agents become more autonomous. Organisations would need to assess not only whether an agent can access information, but also why it is accessing it, and whether the activity aligns with its assigned objective.
Governance Gaps Could Widen
The scale of AI adoption in India could make the issue more pressing. According to Proofpoint’s 2026 AI and Human Risk Landscape report, 63% of Indian organisations reported a suspicious or confirmed AI-related incident. Only 57% said they were fully prepared to investigate an AI or agent incident, while 26% were not fully confident their controls would detect a compromised AI system.
These findings point to a gap between deploying AI systems and establishing the controls needed to monitor them, investigate incidents and contain unauthorised activity. Singh believes organisations must treat AI agents as potential insider risks because an agent does not need to operate outside its assigned permissions to create a security problem.
“An agent can have legitimate access, be executing a legitimate task, and still create risk through how it uses information,” he says.
Monitoring an agent’s behaviour alone would not necessarily establish whether its actions were appropriate. Two agents could perform identical sequences of actions, but one could be completing an authorised task while the other could be operating under malicious instructions or compromised conditions.
For this reason, Singh advocates an approach that evaluates an agent’s intended purpose alongside its behaviour, the data it accesses, and the context in which it operates. He also says access controls should be enforced while an agent is operating, rather than relying on reviews after a task is completed.
“Because agents act at machine speed, this has to be enforced at runtime, with controls that can monitor, constrain, and stop an agent,” he states.
Risk From Foreign AI Agents?
The Australian and South Korean incidents also raise questions about governments relying on externally developed AI systems to perform tasks involving public-sector data. However, Singh says, “The risk isn’t where an agent comes from. It’s whether you can see and control what it does with your data.”
He argues that domestically developed systems could create similar vulnerabilities if they were given excessive access or deployed without adequate monitoring. Sovereign sourcing, therefore, would not by itself guarantee security.
“Organisations should protect AI agents the way it protects people. Every agent should have an identity, scoped access, continuous oversight, and accountability for its actions, with the same rigour applied to a human user,” Singh says.
This means government AI procurement and deployment frameworks must consider more than where a model was developed.
They will also need to establish how an agent is authenticated, what information it can access, which actions it can perform, and whether those actions can be interrupted when they deviate from their intended purpose.
India Continues to Monitor
A senior Government of India official tells AIM that the government remained vigilant against emerging cyber threats.
“The Government of India remains fully vigilant against the evolving cyber threat landscape, including AI-driven attacks and vulnerabilities targeting digital infrastructure,” the official states.
The official added that agencies such as CERT-In and the National Critical Information Infrastructure Protection Centre (NCIIPC) continuously monitor threats, issue advisories, and support incident response and recovery.
“Comprehensive cybersecurity audits, conducted regularly across critical government infrastructure, help identify and address vulnerabilities proactively,” the official says.
The official also points to CERT-In’s empanelled security audit ecosystem and continuous threat intelligence that strengthen the resilience and security of government websites and digital services.
However, the incident highlights a specific challenge for these safeguards: security systems must account for AI agents that can perform complex sequences of actions using legitimate access, rather than only conventional attacks involving stolen credentials or unauthorised entry.
It also raises questions about disclosure timelines and accountability when AI-related security failures occur. In Australia, the delay between the June incident, OpenAI’s internal identification of the activity in August, and the September notification to a government agency became a point of contention.
As governments move from experimenting with AI assistants to deploying agents capable of acting across multiple systems, cybersecurity frameworks will need to address both technical controls and clear obligations for reporting incidents.
Your reaction