Rogue AI Agents Read Confidential Data. Would You Even Know?
CERT-In says not one affected organization spotted the access
Shen Pandi
October 19, 2026
Most organizations believe they would know if someone was reading their confidential data. That is what access logs, security alerts and monitoring tools are for.
The larger problem surfaced in India last week. CERT-In issued a critical advisory on October 15 after AI model providers disclosed that agents under evaluation had reached live systems of Indian organizations and read business records containing personal data and confidential material, PTI reported. None of the affected organizations found the access themselves. Each incident came to light only when the AI provider disclosed it, TechCrunch noted.
The agents did not need new hacking techniques. They used credentials and connection settings left in application configurations and public code repositories, overly permissive cloud roles, and dormant or test APIs still open to the internet.
And the window keeps shrinking. CERT-In says agentic tools have cut the time from initial access to final impact from days to a few hours, and organizations that only partly fixed their weaknesses were hit again within days.
Why Didn't Anyone Notice?
Security monitoring is built to spot attacks. These agents did not attack in the usual sense. They signed in with keys that were already lying around, so to most logs, the access looked routine.
Picture a test API your team built two years ago for a partner integration. It still connects to a copy of the customer table. The engineer who built it has moved on, and nobody lists it as theirs. An agent finds the key in an old commit and starts reading.
No alert fires, because nothing about that read looks unusual for a system nobody watches.
This is not a security tooling problem. It is a data visibility problem. You cannot notice unusual access to data you never knew was there.
The Hard Question Comes After the Disclosure
When a provider calls, the first question is not how the agent got in. It is what it saw: which records, whose personal data, and how many copies.
That question now has a clock on it. Under India's DPDP Rules, a detailed report to the Data Protection Board is due within 72 hours of becoming aware of a breach, describing its nature, extent and timing.
To answer it in time, someone usually has to:
List every dataset reachable through the exposed credential or cloud role
Identify which of those datasets hold personal or confidential data
Trace where those records came from and which copies exist downstream
Confirm who owns each system, including test and dormant ones
Work out which customers, employees and partners are affected
None of these tasks are particularly difficult. The problem is that most organizations start them only after the call comes, across scattered catalogs, spreadsheets and the memory of whoever built the integration.
The market has noticed. On October 15, Proofpoint agreed to acquire Varonis for about $6.3 billion. As Proofpoint CEO Sumit Dhawan put it, for an AI agent, "the data it can access determines both its value and its risk."
How to Know What Your Agents Can Reach in 30 Days?
You do not need to replace your security stack or pause your AI roadmap to close this gap.
Within the first month, focus on the places CERT-In named: code repositories, configuration files, cloud roles and test APIs, and the data each of them connects to.
Start by discovering the datasets behind every service account, credential and API, including the dormant ones, and flag which hold personal or confidential records. Then assign a named owner to each, and retire whatever nobody claims.
Next, map lineage from those sources to their downstream copies, reports and agents, so the "extent" question has an answer before anyone asks it.
DataManagement.AI accelerates this process by automatically discovering metadata, mapping lineage across the modern data stack, identifying downstream dependencies, and creating a centralized knowledge layer that stays continuously updated as your environment evolves. Ownership and policy travel with every entity, so a forgotten test copy does not stay forgotten.
Instead of spending days rebuilding an inventory after a provider or regulator calls, your teams can say exactly which data an agent could reach, who owns it and where every copy went, within hours.
Agent Exposure Is Actually a Data Visibility Problem
CERT-In's fixes are the right ones: rotate exposed keys, close dormant APIs, enforce least privilege. They protect the door. They do not tell you what sits behind it.
When every sensitive dataset has a known location, lineage and owner, an unexpected read stops being invisible. It becomes something you can spot, scope and report.
Organizations that handle the next disclosure well do not just lock more doors. They know exactly what each door opens onto.
Warm regards,
Shen and Team