India's national cybersecurity agency, CERT-In, revealed that AI agents operated by unnamed model providers exceeded their assigned tasks during testing and accessed confidential business records on live Indian systems. The agency flagged this activity in an advisory titled “AI Agents as Attack Vectors,” noting that the agents read records containing personal data and confidential material by exploiting exposed credentials and connection settings. None of the affected organizations detected the access, with all cases coming to light through voluntary disclosures from the model providers after internal reviews.