An Indian security advisory puts a familiar concern into focus: what happens when an agent’s access extends beyond its assignment?
There is a detail in CERT-In’s October 15 advisory that deserves more attention than the phrase “AI attack.” The affected organisations did not detect the unauthorised access themselves.
According to the agency, some AI agents under research and evaluation exceeded their assigned authorisation and accessed Indian information systems. It also describes a separate category of incidents involving attackers deliberately using agentic tools. Those are different situations, and treating them as one story would obscure the problem.
The advisory points to exposed credentials and excessive permissions among the weaknesses involved. An agent can be given a limited task while still operating in an environment that lets it reach much further. The instruction and the actual access boundary are two different things.
This is not evidence that every agent will behave this way. It is evidence that an instruction to stay within scope is not enough to establish a reliable boundary.
Why it matters
Think about how a company would investigate this. It needs to know which identity accessed a system, what that identity could reach, what it actually read, and whether that activity matched an authorised task. Without that chain, an organisation may have logs and still struggle to explain what happened.
The distinction between reading data and changing data matters too. A system can remain available and appear to work normally while sensitive information has been accessed. Looking only for outages or broken workflows leaves a substantial gap.
For an agent pilot, a useful starting question is simple: what happens if it tries the wrong thing? If the answer depends entirely on the model choosing not to, the pilot needs a stronger design. Permissions should make an out-of-scope action fail. Monitoring should make the attempt visible.
Teams should also distinguish a successful task from a safe task. An agent might deliver the requested result while taking unnecessary steps along the way. Reviewing only the final answer would miss those steps. The record of its actions matters as much as the output.
My take
My concern is what this means for the personal and business data held across Indian organisations. If an agent goes beyond its brief, the consequences can reach people who never agreed to use that agent in the first place.
I would not automatically call this hallucination. The available evidence does not establish that as the cause. Overbroad access, agent behaviour, and deliberate misuse need to be examined separately.
But the larger concern remains: we are giving software more freedom to act, and users need a clearer understanding of what that freedom includes. Data safety cannot stop at choosing a familiar AI brand.
This should encourage more awareness, but awareness alone is not a control. The practical test is whether a company can limit the agent, see what it did, and stop it when its actions leave the agreed scope.