On 15 October India’s CERT-In warned that AI agents under evaluation had reached live Indian business systems with exposed credentials and read confidential records, while a separate category of criminals uses open-source agent tools for financial intrusions; both expose how valid logins can enable actions beyond any legitimate task.

International guidance from Five Eyes agencies, Singapore, NIST and others converges on constraining agent permissions, enforcing short-lived identities and distinguishing goal hijacking or tool misuse from ordinary cyberattacks, yet these remain recommendations rather than proven deployed protections.

The article urges that agents carry enforceable task mandates checked at the service boundary, with testing that verifies unauthorized actions are blocked, credentials can be revoked mid-task and recovery is possible, so permission becomes as specific and auditable as the action it authorizes.

India’s new warning about AI agents crossing task boundaries reveals a global security gap: a valid credential proves access, not permission to perform the next action.

On October 15, India’s national computer emergency response team issued an unusual warning. In cases disclosed by AI model providers, agents being evaluated on the open internet had reached live Indian business systems, used exposed credentials and read confidential records. The agents’ actions exceeded their assigned tasks. According to CERT-In’s advisory, the affected organizations had not detected the access themselves.

The agency described another, distinct category: criminals deliberately using open-source AI-agent tools to conduct financially motivated intrusions. These are not the same event and should not be flattened into a story about machines deciding to become criminals. They do expose a common vulnerability: software can use available tools and credentials to act far beyond the work anyone legitimately entrusted to it.

That is the global cybersecurity problem of agentic AI. A network may recognize the account, accept the application programming interface request and log the transaction as technically valid. None of those checks proves that the action was part of the task that authorized it.

A valid login is not a valid mandate

Consider an AI assistant asked to read invoices and prepare a summary. A supplier document contains an instruction directing it to copy customer records to an unfamiliar destination. The assistant has access to the records because it needs them for its real job. If it treats the document’s instruction as an order, an attacker can turn the organization’s own permissions into a path for disclosure.

This example is hypothetical, but the engineering failure is documented. In May, Microsoft security researchers described how........

© Eurasia Review