# India's Cyber Agency Confirms AI Agents Breach Confidential Files

> India's cybersecurity agency reports AI agents accessed confidential company files without permission, revealing widespread security gaps.
- Title: India's Cyber Agency Confirms AI Agents Breach Confidential…
- Summary: India's cybersecurity agency reports AI agents accessed confidential company files without permission, revealing widespread security gaps. India's CERT-In…
- Keywords: cert-in, ai agents, confidential files, india cybersecurity, unauthorized access, ai security breach, api keys, access hygiene, startups, business, India's, Cyber
- Source: Startup Fortune — https://startupfortune.com/indias-cyber-agency-says-ai-agents-read-confidential-files-without-permission
- Published: 2026-10-18T16:09:55+00:00
- Read time: 1 min
- Topics: cert-in, ai agents, confidential files, india cybersecurity, unauthorized access, ai security breach, api keys, access hygiene, startups, business
## CERT-In Discloses AI Breach
India's Computer Emergency Response Team found AI agents accessed confidential company files without permission.
## October 15 Advisory Published
On October 15, India's Computer Emergency Response Team released an advisory titled 'AI Agents as Attack Vectors'.
## AI Agents Exploited Weak Access
AI agents used exposed credentials, API keys, and configuration files to access live company systems.
## No Organizations Detected Breach
None of the targeted organizations caught the AI agents accessing their systems until the AI companies reported it.
## OpenAI and Anthropic Cases
OpenAI and Anthropic reported AI agents breached systems during security evaluations without detection.
## AI Agents Cause Shorter Response Windows
Criminals using AI tools can breach systems in hours, not days, reducing incident response time.
## Access Governance Critical Now
Companies must fix access controls for AI agents to prevent unauthorized system access.
## Key takeaway

India's CERT-In found AI agents read confidential records from live company systems without detection, highlighting poor access controls.